mediatek: Add a second u-boot for Redmi AX6S #14770
Conversation
981213
added
work in progress
github-actions
bot
added
core packages
What kind of image is this? How to create it? |
It's openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-sysupgrade.itb built in OpenWrt. |
| @@ -9,7 +9,8 @@ case "$(board_name)" in | |||
| uci set system.@system[0].compat_version="1.1" | |||
| uci commit system | |||
| ;; | |||
| linksys,e8450-ubi) | |||
| linksys,e8450-ubi|\ | |||
| xiaomi,redmi-router-ax6s) | |||
There was a problem hiding this comment.
Maybe it's a chance to remove support for this device and add a new one redmi,ax6s instead. I remember Redmi is a standalone brand. It's not a series of Xiaomi.
There was a problem hiding this comment.
@DragonBluep
You are in vain trying to use marketing names.
Each Xiaomi router has a sticker on which the model name is written.
AX6S = RB03
AX3200 = RB01
Here's a look at ipq806x-based devices: https://github.com/openwrt/openwrt/tree/main/target/linux/ipq806x/files/arch/arm/boot/dts
It is not the marketing name of the router that is used, but the model name.
The marketing name must be indicated here:
DEVICE_ALT1_MODEL :=
There was a problem hiding this comment.
The name should be vendor,model. I think we should keep Xiaomi as it's the actual vendor.
There was a problem hiding this comment.
You are in vain trying to use marketing names.
Each Xiaomi router has a sticker on which the model name is written.
AX6S = RB03
AX3200 = RB01
So the correct model should be xxx,rb03. Sadly, there are no Xiaomi devices using the correct model name.
The name should be
vendor,model. I think we should keep Xiaomi as it's the actual vendor.
At least Xiaomi devices have the MI logo but Redmi devices have the Redmi logo. Anyway, they still share the same official site. Their relationship is more like Mercury and TP-Link.
There was a problem hiding this comment.
@DragonBluep
Certification for AX3200 (RB01): https://portal.eaeunion.org/sites/odata/_layouts/15/Portal.EEC.Registry.UI/DisplayForm.aspx?ItemId=77047&ListId=d84d16d7-2cc9-4cff-a13b-530f96889dbc
I don't see the redmi name!
There was a problem hiding this comment.
So the correct model should be
xxx,rb03
Yes. I believe that developers should use precise notations, and not those that marketers force.
Sadly, there are no Xiaomi devices using the correct model name.
You are not right. Each firmware image for an Asus router has the exact model name in the header.
Likewise, in every firmware image for a Xiaomi router, the header contains the exact name of the model.
I checked this installation method. It works! uart logs``` Writing to NAND... OK Booting System 0NAND read: device 0 offset 0x2c0000, size 0x2000 NAND read: device 0 offset 0x2c0000, size 0x3d800 Loading kernel from FIT Image at 4007ff28 ...Using 'config-1' configuration Starting kernel ... [ATF][ 4.128532]save kernel info U-Boot 2024.01-OpenWrt-r25402-012be0468c (Mar 02 2024 - 14:26:04 +0000) CPU: MediaTek MT7622 Checking Image at 46000000 ...FIT image found Checking hash(es) for FIT Image at 46000000 ...Hash(es) for Image 0 (kernel-1): crc32+ sha1+ F0: 102B 0000 UNIVPLL_CON0 = 0xFE000000!!! [BLDR] Build Time: 20210316-161525 [DDR] Gating glitch patched (0<cnt<=6) [EMI]rank size auto detect [PART] blksz: 2048B Device APC domain init setup: Domain Setup (0x0) [PART] load "lk" from 0x00000000000C0200 (dev) to 0x41E00000 (mem) [SUCCESS] [PART] load "tee1" from 0x0000000000080200 (dev) to 0x43000DC0 (mem) [SUCCESS] [BLDR] jump to 0x41E00000 U-Boot 2014.04-rc1 (Sep 03 2021 - 08:42:53) auto detection g_total_rank_size = 0x F000000 *** U-Boot SPI NAND *** trigger button release! NAND read: device 0 offset 0x2c0000, size 0x2000 NAND read: device 0 offset 0x2c0000, size 0x3d800 Loading kernel from FIT Image at 4007ff28 ...Using 'config-1' configuration Starting kernel ... [ATF][ 4.128802]save kernel info U-Boot 2024.01-OpenWrt-r25402-012be0468c (Mar 02 2024 - 14:26:04 +0000) CPU: MediaTek MT7622 Checking Image at 46000000 ...FIT image found Checking hash(es) for FIT Image at 46000000 ...Hash(es) for Image 0 (kernel-1): crc32+ sha1+ Loading kernel from FIT Image at 46000000 ...Using 'config-1' configuration Loading fdt from FIT Image at 46000000 ...Using 'config-1' configuration Loading loadables from FIT Image at 46000000 ...Trying 'rootfs-1' loadables subimage Starting kernel ... [ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034] |
|
This new way of arranging the kernel and rootfs completely breaks facinstall and XMiR-Patcher work. And it’s probably worth adding the following lines to simplify the initial flash firmware: |
Thanks!
Does appending a sysupgrade.itb really work? I think if we do append-ubi instead, we can write the entire factory.bin to the first firmware partition. |
I don't know yet. |
I tried to flash OpenWRT under the stock firmware: uart logsroot@XiaoQiang:/# mtd -r write /tmp/factory.bin firmwareUnlocking firmware ... Writing from /tmp/factory.bin to firmware ... F0: 102B 0000 UNIVPLL_CON0 = 0xFE000000!!! [BLDR] Build Time: 20210316-161525 [DDR] Gating glitch patched (0<cnt<=6) [EMI]rank size auto detect [PART] blksz: 2048B Device APC domain init setup: Domain Setup (0x0) [PART] load "lk" from 0x00000000000C0200 (dev) to 0x41E00000 (mem) [SUCCESS] [PART] load "tee1" from 0x0000000000080200 (dev) to 0x43000DC0 (mem) [SUCCESS] [BLDR] jump to 0x41E00000 U-Boot 2014.04-rc1 (Sep 03 2021 - 08:42:53) auto detection g_total_rank_size = 0x F000000 *** U-Boot SPI NAND *** trigger button release! NAND read: device 0 offset 0x2c0000, size 0x2000 NAND read: device 0 offset 0x2c0000, size 0x3d800 Loading kernel from FIT Image at 4007ff28 ...Using 'config-1' configuration Starting kernel ... [ATF][ 4.128443]save kernel info U-Boot 2024.01-OpenWrt-r25402-012be0468c (Mar 02 2024 - 14:26:04 +0000) CPU: MediaTek MT7622
|
|
structure of ubi: Storage info:
|
|
@Remitor I was able to flash from stock by first flashing the initramfs recovery image and then doing the sysupgrade from there. |
There shouldn't be a data volume at all. That's strange. |
I dumped this volume and found configs from the stock firmware inside. And I don’t understand how this happened. Then I downloaded the I waited for the download and ran the following commands: After this, the system loading stopped at this point: uart logs
Booting System 0
@981213 |
|
Fixes: image maker now volume uart logs
U-Boot 2024.01-OpenWrt-r25402-012be0468c (Mar 02 2024 - 14:26:04 +0000)
Now this command works when flashing from stock firmware: |
981213
force-pushed
the
ax6s
branch
2 times, most recently
from
ea350e4
to
4163b02
Compare
|
@981213 And there is another way to fix this situation: Example: |
|
Removing -squashfs- from image name will cause conflicts when multiple filesystem types are enabled. |
It's understood. |
|
Offtopic question: Ontopic question: Am I missing something? I built the |
|
@xabolcs did you run |
|
Just a |
Only But my original - offtopic - question is still open. 😅 |
I could try building factory.bin in IMAGE instead of ARTIFACTS. Haven't thought of a good way to do that yet.
No. The u-boot in this PR is packaged alone into an fit image, and BL2 won't recognize it. For that to work you need to edit the uboot-mediatek Makefile to package u-boot with ATF into an FIP, like what other devices are currently doing. |
| @@ -9,7 +9,8 @@ case "$(board_name)" in | |||
| uci set system.@system[0].compat_version="1.1" | |||
| uci commit system | |||
| ;; | |||
| linksys,e8450-ubi) | |||
| linksys,e8450-ubi|\ | |||
| xiaomi,redmi-router-ax6s) | |||
There was a problem hiding this comment.
So the correct model should be
xxx,rb03
Yes. I believe that developers should use precise notations, and not those that marketers force.
Sadly, there are no Xiaomi devices using the correct model name.
You are not right. Each firmware image for an Asus router has the exact model name in the header.
Likewise, in every firmware image for a Xiaomi router, the header contains the exact name of the model.
| +boot_production=run ubi_read_production && bootm $loadaddr#$bootconf | ||
| +ubi_format=ubi detach ; mtd erase ubi && ubi part ubi | ||
| +ubi_init=ubi part ubi || run ubi_format | ||
| +ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi |
There was a problem hiding this comment.
I suggest adding additional logging:
ubi_prepare_rootfs=echo "run ubi_prepare_rootfs" ; if ubi check rootfs_data ; then echo "volume rootfs_data already exists"; else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
There was a problem hiding this comment.
I don't really like this kind of verbose logs. As we already have to write an entire script in one line, I think it's better to keep it short for better readability.
| define Build/uboot-bin | ||
| cat $(STAGING_DIR_IMAGE)/mt7622_$1-u-boot.bin >> $@ | ||
| endef | ||
|
|
||
| define Build/uboot-fit | ||
| $(TOPDIR)/scripts/mkits.sh \ | ||
| -D $(DEVICE_NAME) -o $@.its -k $@ \ | ||
| -C $(word 1,$(1)) \ | ||
| -a 0x41e00000 -e 0x41e00000 \ | ||
| -c "config-1" \ | ||
| -A $(LINUX_KARCH) -v u-boot | ||
| PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage -f $@.its $@.new | ||
| @mv $@.new $@ | ||
| endef |
There was a problem hiding this comment.
These functions need to be moved to the main Makefile, since they are also needed for filogic targets.
Example: openwrt-xiaomi@f10db88
Function uboot-fit needs to be improved (made universal).
Example: openwrt-xiaomi@f10db88
There was a problem hiding this comment.
I don't think this kind of standalone utilities need to be included in the main OpenWrt tree. It can be built directly from mainline u-boot and live in a mainline u-boot fork instead.
BTW it'll be more complicated on filogic because the vendor bootchain expects UBI on top of NMBM. Our u-boot knows nothing about NMBM and it shouldn't be directly manipulating the UBI area.
|
This doesn't seem usable on devices with GD5F1GQ5xExxG flash. The existing uboot doesn't know anything about that chip, and adding the ID results in it treating every single block as bad. |
|
@K900 I've added support to that flash and it seems fine here. Could you test again with the latest version in my PR? |
|
@981213 I confirm that the issue is resolved for me. |
|
@981213 Is it possible to build a initramfs-factory.ubi equivalent variant of the firmware similar to what RobiMarko did for AX3600: https://firmware-selector.openwrt.org/?version=SNAPSHOT&target=qualcommax%2Fipq807x&id=xiaomi_ax3600 This firmware was used to allow a simple means of transitioning from the original 2 data partitions to a single one on that device even from Luci just before support was merged to master. Prior to that (in testing) it was 2 partitions for all the testers. i.e. flash initramfs-factory.ubi, then when the router comes back up flash 'normal' sysupgrade bin. Separately, if this PR is the path that is going to be taken (vs. the other PR), it would be awesome if the first post could be updated with the commands needed to update directly from openwrt cli. |
It's not possible for AX6S because updating the firmware from the Web UI will not work because of signature checks that aren't defeated yet. It does build a or from the stock firmware do: Afterwards the sysupgrade images will work as expected. |
|
Fantastic! I would absolutely update the top post with this info as well. |
Weirdly, I made the same change and it didn't work, but I just tried it on latest master and now it does. |
|
OK, so I've been running this for a bit and it's been working just fine. The install process I used is a bit different from what has been documented here I think, so I'll describe it for posterity:
The nice thing about this approach is that it doesn't actually require any specific firmware or firmware-specific setup, you just need the factory u-boot to be present. I'm not sure if there's a good way to make the second stage loader write itself to flash so you can just tftpboot it once and have everything set up, but that would make this flow even nicer. |
Add support for Xiaomi Redmi AX6S to be used as a second-stage UBI loader. The defconfig/env is minimal: Boot fit from UBI. If that failed, load and boot initramfs image from TFTP. Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
This patch adds support for GigaDevice GD5F1GQ5UExxG to the mtk-snfi driver in u-boot. Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
981213
removed
work in progress
981213
changed the title
The vendor u-boot knows nothing about UBI, and we used to have a fixed-size kernel partition for vendor u-boot and UBI for rootfs. However, that fixed partition becomes too small eventually, and expanding it requires complicated procedure. This commit changed the flash layout and added a second u-boot where the kernel supposed to be. Now the vendor u-boot chainloads our mainline u-boot, and our u-boot reads kernel+rootfs from UBI, verifies it, and boot into OpenWrt. There are two possible ways to convert from the old fw: Flash the factory image using mtd (provided by @rany2): mount -o remount,ro / mount -o remount,ro /overlay cd /tmp dd if=factory.bin bs=1M count=4 | mtd write - kernel dd if=factory.bin bs=1M skip=4 | mtd -r write - ubi Or, flash the 2nd u-boot via mtd and upload the firmware to the 2nd u-boot using tftp: 1. prepare a tftp server at 192.168.1.254 to serve the sysupgrade image: openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-sysupgrade.itb 2. upload the ubi-loader.itb to OpenWrt /tmp, and flash it to the old kernel partition: mtd -r write openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-ubi-loader.itb 3. The router should reboot and flash the sysupgrade image via TFTP. Procedure for flashing from vendor firmware shouldn't change. Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
|
I've merged this PR into main. |
Packaging U-Boot with ATF into a FIP, like the others. Ref: openwrt#14770 (comment) Suggested-by: Chuanhong Guo <gch981213@gmail.com> Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
Packaging U-Boot with ATF into a FIP, like the others. Ref: openwrt#14770 (comment) Suggested-by: Chuanhong Guo <gch981213@gmail.com> Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
Packing U-Boot with ATF into a FIP, like the others. Ref: openwrt#14770 (comment) Suggested-by: Chuanhong Guo <gch981213@gmail.com> Signed-off-by: Szabolcs Hubai <szab.hu@gmail.com>
The vendor u-boot knows nothing about UBI, and we used to have a fixed-size kernel partition for vendor u-boot and UBI for rootfs. However, that fixed partition becomes too small eventually, and expanding it requires complicated procedure.
This commit changed the flash layout and added a second u-boot where the kernel supposed to be.
Now the vendor u-boot chainloads our mainline u-boot, and our u-boot reads kernel+rootfs from UBI, verifies it, and boot into OpenWrt.
Converting from old layout:
prepare a tftp server at 192.168.1.254 to serve the sysupgrade image:
openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-sysupgrade.itb
upload the ubi-loader.itb to OpenWrt /tmp, and flash it to the old kernel partition:
mtd -r write openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-ubi-loader.itb
The router should reboot and flash the sysupgrade image via TFTP.
Flashing from vendor firmware should go like this:
Help wanted:
This entire PR is made on a different board with a Xiaomi u-boot dump. It's not tested on a real Redmi-AX6S.
It would be great if someone with serial console access can: