Add OpenWrt support for Xiaomi "Redmi AX6000"

Newuser · January 3, 2023, 9:58pm

Hi all,

This is my first post here, so first of all, I would like to thank you all for this amazing forum !

jav:

if firmware=0, current system is ubi, flash to ubi1:
ubiformat /dev/mtd9 -y -f /tmp/initramfs-factory.ubi
Reboot and setup uboot-env
reboot then it should boot to the openwrt initramfs system now, login ssh and setup:

As to the issue I have - I carefully followed the instructions @jav posted, but unfortunately after I completed step #5 and rebooted the router, I lost any access to it (according to the constant blue lights on it - it is not in a "debug mode" anymore).

My questions are:

a) Is there anything I can do to debrick the router? I have a few serial adapters (such as CP2102), but I'm not sure how to open the case and whether there is any way to connect them to the router..

b) as instructed above, I used @dimfish 's ubi initramfs-factory.ubi; but I'm wondering - could I use an official snapshot instead?

c) What did I do wrong?

My router's version is (or was..): 1.0.48.

Any assistance would be greatly appreciated!

jav · January 3, 2023, 10:11pm

With the new image (ubootmod) this process is outdated. Please see:

github.com/openwrt/openwrt

uboot-mediatek: add support for Xiaomi Redmi Router AX6000

Commit by

HZFrodo in uboot-mediatek: add support for Xiaomi Redmi Router AX6000

openwrt:master ← HZFrodo:rm-ax6000-uboot-prereq

U-Boot flash instructions: 0. OpenWrt U-Boot does not support stock layout, it …comes with recovery boot support, automatic tftp recovery and never blocks UART. A new flash layout is introduced, we call it OpenWrt U-Boot layout, stock flash layout and the old OpenWrt layout are not supported. During the whole flash procedure, please do not reboot or power off unless requested explicitly, or you will break your device. 1. Your device should already running OpenWrt. If not, follow the instructions to flash OpenWrt: https://github.com/openwrt/openwrt/pull/11115 2. Backup BL2 Nvram Bdata Factory and FIP in case you break something or in case you want to go back to stock firmware one day. cat /dev/mtdblock0 > /tmp/BL2.bin cat /dev/mtdblock1 > /tmp/Nvram.bin cat /dev/mtdblock2 > /tmp/Bdata.bin cat /dev/mtdblock3 > /tmp/Factory.bin cat /dev/mtdblock4 > /tmp/FIP.bin And save all whose bin files to somewhere safe. Then backup your configurations, since ubiformat for entire mtd device is required to create new ubootenv volume for OpenWrt U-Boot. 3. Run the following cmd to boot into an initramfs with the new OpenWrt U-Boot layout that expand ubi partion to the end of flash: ubiformat /dev/mtd7 -y -f /tmp/ax6000-ubootmod-initramfs-factory.ubi 4. After boot into initramfs, check mtd partion info. The ubi partion should be mtd5 root@OpenWrt:~# cat /proc/mtd dev: size erasesize name mtd0: 00100000 00020000 BL2 mtd1: 00040000 00020000 Nvram mtd2: 00040000 00020000 Bdata mtd3: 00200000 00020000 Factory mtd4: 00200000 00020000 FIP mtd5: 07a80000 00020000 ubi 5. Load kmod-mtd-rw to temporarily make the bootloader partions writable. The kmod-mtd-rw is from the feeds, it is not packed in initramfs-factory by default. To install kmod-mtd-rw via opkg: opkg update && opkg install kmod-mtd-rw Or, download kmod-mtd-rw.ipk from OpenWrt server and install it manually e.g: https://downloads.openwrt.org/snapshots/targets/mediatek/filogic/kmods/ Select your OpenWrt release version and kernel version accordingly. Load kmod-mtd-rw: insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1 6. Run the following cmd to clean all pending crash dumps in pstore, or OpenWrt U-Boot may boot into NAND recovery or tftp recovery. rm -f /sys/fs/pstore/* 7. Format ubi and create new ubootenv volume: ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5 ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB 8. This is optional. Skip this if you do not want to have NAND recovery boot feature offered by OpenWrt U-Boot. Don't worry, you always have automatic tftp recovery feature enabled. ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB ubiupdatevol /dev/ubi0_2 /tmp/ax6000-ubootmod-initramfs-recovery.itb 9. Now, flash new U-Boot. Bye-bye ugly stock U-Boot. mtd write /tmp/ax6000-ubootmod-preloader.bin BL2 mtd write /tmp/ax6000-ubootmod-bl31-uboot.fip FIP 10. Flash the squashfs-sysupgrade.bin as usual: sysupgrade -n /tmp/ax6000-ubootmod-squashfs-sysupgrade.itb Enjoy! Signed-off-by: Furong Xu <xfr@outlook.com>

You can decide on which of the two options (stock or ubootmod) to stay.

Anyway, with that image it should work.

Things to check from where you are:

Is it really bricked? Doesn't respond to ping at 192.168.1.1 (from one of the LAN ports)?
If not, can you check if it's generating any traffic (with tcpdump or wireshark)?
If it's bricked, rebooting it 6 times should bring back the original firmware, and you can retry from there.
Serial port can be accessed without opening the case. You can see the serial port through the fins in the bottom of the router, and connect to it through them. Works fine and you'll be able to load another firmware. I rescued my first AX6000 that way.

I hope it helps.

Newuser · January 3, 2023, 10:20pm

Many thanks for the prompt reply!

I'll try this (probably tomorrow) and update. Thanks!

darksky · January 3, 2023, 10:35pm

I might be misreading this but coming from the stock Redmi AX6000, what is the new flash process if not first following the steps linked PR#11115 (step 1)?

Newuser · January 3, 2023, 10:40pm

@jav you are right! It is not bricked ! I mistakenly left the cable connected to the WAN port (stupid me).

I was able to establish ssh connection to the router and it says "OpenWrt SNAPSHOT, r0-2e737aa".

Given this situation, what is my next step? Continuing following the instructions above (to step #6 - "setup uboot-env") or doing something else? I would like to update to the most recent snapshot version.

Thank you!

jav · January 3, 2023, 10:48pm

Right now, the process would be to start with PR#11115 (step 1), and if you just want the stock flavor, you're done. If you want to go ubootmod flavor, follow the complete guide of the commit.

If you're already in the former flavor (non-stock one), you can switch over as I explained in

jav · January 3, 2023, 11:03pm

Good to know

I'd suggest you replace the initramfs you flashed with the stock layout one from the latest snapshot (step 4 of PR#11115)

ubiformat /dev/mtdX -y -f /tmp/initramfs-factory.ubi

Remember to use the right /dev/mtdX device (the same one you used on the first attempt). If unsure, do fw_printenv flag_boot_rootfs to check (0 = ubi, 1 = ubi1, use cat /proc/mtd to verify the partition number)

Once done, reboot and you should be able to continue installation from step 5 of PR#11115.

Newuser · January 3, 2023, 11:55pm

Thank you!

Just verifying to avoid unnecessary mistakes

fw_printenv flag_boot_rootfs returns "flag_boot_rootfs=1", and cat /proc/mtd returns:

dev:    size   erasesize  name
mtd0: 00100000 00020000 "BL2"
mtd1: 00040000 00020000 "Nvram"
mtd2: 00040000 00020000 "Bdata"
mtd3: 00200000 00020000 "Factory"
mtd4: 00200000 00020000 "FIP"
mtd5: 00040000 00020000 "crash"
mtd6: 00040000 00020000 "crash_log"
mtd7: 06e00000 00020000 "ubi"

Now, I'm confused a little bit because previously I ran the following command: "ubiformat /dev/mtd9 -y -f /tmp/initramfs-factory.ubi", while now it seems that there is no mtd9... only mtd7 (and the instructions refer to mtd8 or mtd9 only).

Is mtd7(ubi) the relevant partition in my case?

Thank you!

sleepyeye · January 4, 2023, 7:13am

I followed the suggested step, now I rewinded the device to initial status.
Thanks.

jav · January 4, 2023, 7:29am

Original firmware has a slightly different partition numbering scheme.

Try:

fw_setenv boot_wait on
fw_setenv uart_en 1
fw_setenv flag_boot_rootfs 0
fw_setenv flag_last_success 1
fw_setenv flag_boot_success 1
fw_setenv flag_try_sys1_failed 8
fw_setenv flag_try_sys2_failed 8
fw_setenv mtdparts "nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),2048k(factory),2048k(fip),256k(crash),256k(crash_log),30720k(ubi),30720k(ubi1),51200k(overlay)"

And flash the new initramfs to /dev/mtd7

Newuser · January 4, 2023, 9:34pm

Thank you, @jav !

I executed all the commands in your post and then continued from step #5 of PR#11115.

However, after I ran sysupgrade -n /tmp/stock-squashfs-sysupgrade.bin, I received the following error:

"invalid sysupgrade file
Mon Jan  2 09:43:08 UTC 2023 upgrade: Commencing upgrade. Closing all shell sessions.
Command failed: Connection failed"

Afterwards when I tried to establish SSH connection to the router, I received a warning message that said: "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!" Doesn't it mean that sysupgrade succeeded?

Now cat /proc/mtd returns the following results:

dev:    size          erasesize  name
mtd0: 00100000 00020000 "BL2"
mtd1: 00040000 00020000 "Nvram"
mtd2: 00040000 00020000 "Bdata"
mtd3: 00200000 00020000 "Factory"
mtd4: 00200000 00020000 "FIP"
mtd5: 00040000 00020000 "crash"
mtd6: 00040000 00020000 "crash_log"
mtd7: 01e00000 00020000 "ubi_kernel"
mtd8: 05000000 00020000 "ubi"

fw_printenv flag_boot_rootfs returns:
flag_boot_rootfs=0

Current OpenWrt version is: SNAPSHOT, r21657-9260027535 (which appeared after I flashed initramfs to /dev/mtd7).

How do I know if sysupgrade worked? and what is my next step ?

Thank you again for your help!

SparkyDan555 · January 4, 2023, 10:54pm

I've just flashed a brand new AX6000 and I'm experiencing similar issues. I get 900/100 service which is stable on ethernet. But over AX WiFi, it behaves very unpredictable. See this nperf speed test. The peaks are at 850 mbps but then it will randomly drop to around 10 mbps. I have tried channel 36 and 100 and see it with both in 160 MHz mode. The client is a 2021 M1 MacBook Pro (A2442).

I never had these issues with the previous AX3200 in 160 MHz mode auto channel. Local iPerf tests give similar results fluctuating between 850 and 70 mbps averaging around 300 mbps. In my case 80 MHz is even worse, around 0.5 mbps. This test was at 80 MHz channel 52.

AC @ 80 MHz channel 132 is better, especially upload, but still not as good as it was:

Any ideas how to resolve this?

jav · January 5, 2023, 12:18am

@Newuser sysupgrade worked. That's just a bug that can be ignored, and the "REMOTE HOST IDENTIFICATION" means that the ssh keys were regenerated.

Now you can stick to the stock version, and that's fine, or you can move to the ubootmod version, using the ubootmod guide I linked above. Your choice.

Anyway, you can go ahead and configure and enjoy OpenWrt.

EUA · January 5, 2023, 12:25am

I heard that there was a problem on some of Mac service daemon that makes a private broadcast for other mac devices, using WiFi chip for mac dedicated connection sharing feature for cellular phone etc... Probably send a beacon each 100ms and it creates some problem with AX wifi devices... I don't remember what the service name was or where do I read that. You might try to find it and disable that service to avoid that effect for example...

Edit: I found the article https://www.meter.com/mac-osx-awdl-psa

in short; re-test with:
sudo ifconfig awdl0 down

Newuser · January 5, 2023, 10:54pm

Many thanks @jav !! It seems that everything works

However, I'm not sure that I fully understand what is the practical difference between using stock and u-boot mod (save for the the more efficient space usage..is the additional space really required?).

I believe I that I read somewhere that with stock layout there is a (theoretical) chance that the stock firmware (or its leftovers) will call home (but perhaps I misunderstood the comment). Is this true?

I would like to believe that it is not possible with OpenWrt running on the router.

Thanks!

RidDleZ · January 6, 2023, 1:00am

Hey guys. Flashed a fresh snapshot, even right after it was compiled and can not get SQM to work. Always says kernel is wrong. Anyone get this working? It's a bit of a necessity for me as I've got a garbage DSL modem (I know I know, but I live out in nowhere) that hangs hard if you don't limit it.

Any insight or help would be great.

jav · January 6, 2023, 2:54pm

Key differences between both versions, as I understand them:

stock:

System can be recovered with Xiaomi tools.
Easy original firmware restore.
Less space available.
A failed update can leave the system stuck as in some circumstances (not sure about the details) bootloader starts with UART disabled. In that case, flash may have to be unsoldered to recover.
While uncommon, there's a possibility that stock bootloader calls home.

ubootmod:

Full open-source software, from bootloader.
Cannot be restored with Xiaomi tools.
Original firmware restore complex and unproven.
Most efficient use of flash space.
Multiple recovery mechanisms in case of failed update (serial, tftp, initramfs).
bootloader & factory partitions not protected in case of a future flash block failure in those areas (not sure how much the original bootloader is able to protect them).

darksky · January 6, 2023, 3:44pm

You might want to augment the section I started on the wiki. https://openwrt.org/toh/xiaomi/redmi_ax6000

Also, someone should fact-check what I wrote there about the install procedure/discussion above is still not clear to me.

Vaalberith · January 6, 2023, 9:38pm

Hello! Please, help me a bit.

I had OpenWRT with stock layout (#11115). I tried to switch to uboot mod layout (#11565) step-by-step.
At point 3 i entered mtd -r -e ubi write ax6000-ubootmod-initramfs-factory.ubi ubi instead of origin command, as it was mentioned here. Device rebooted and kept bootlooping. Brick :c

After connecting usb-uart i've seen u-boot menu and option to Load Image, etc.
Please, describe fully what You have done to unbrick it and finish uboot mod layout migration.

Please, describe these steps. Is it Load Image and ubootmod-initramfs-factory through tftp?

Thanks in advance!

soxrok2212 · January 6, 2023, 10:10pm

Use u-boot to tftp boot into the ubootmod initramfs image (connect your pc and host TFTP server at 192.168.31.100 with the ubootmod initramfs image on it, then on UART console tftpboot ubootmod initramfs image bin) then when booted from that, try the steps again. IIRC correctly that’s what I did.

Necessary “I’m not responsible if you brick your bootloader” message here.