Add OpenWrt support for Xiaomi "Redmi AX6000"

I purchased this router, it is on the way..
Do you recommend to flash openwrt at current state? or just wait for stable one.
I will only use it as AP (I have good wired router already)
All I want is fast-stable wifi, specifically purchased this router to use it with openwrt in the long term.

It's stable as any other OW device I run right now. Why wait?

2 Likes

I upgraded to yesterdays snapshot, and got a boot-loop. Nothing worked, tried to boot the other firmware slot, and that also ended in a boot-loop.
TFTP'ed to recover the router, but I must have done something incorrectly when selecting the image to boot up. Now the only thing that is shown over the serial interface is this:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000                                                                                         
F5: 1026 0000                                                                                         
00: 1005 0000                                                                                         
FA: 1040 0000                                                                                         
FA: 1040 0000 [0200]                                                                                  
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
01: 102A 0001
02: 1005 0000
BP: 2000 00C0 [0001]
EC: 0000 0000 [1000]
T0: 0000 00BB [010F]
System halt!

I suspect this is E-junk now? :frowning:

I've upgraded to yesterday's snapshot (custom build) and they're working great. Were you using the right image (factory vs. uboot-mod)? Depending on the one you had, recovery mechanism should be different, but as you have serial interface already, you should have at least u-boot. Did you try to update u-boot too?

thanks for replying.
I ran u-boot with the stock bootloader/flash layout, as i haven't converted from factory flash layout. downloaded the openwrt image (non-uboot mod), but must have done something wrong in that process, I guess.
Please note that the above is the only printout over serial.

There's a known situation in the OEM u-boot in which serial console is disabled. It's either that, or you've overwritten u-boot (I doubt it, as requires some non-trivial steps to be able to do that).

Have you check in the LAN ports if it's any traffic from the router (tcpdump, wireshark)? Sometimes the OEM u-boot tries to recover from there.

If not, you'll need a programmer to reflash.

Nor wireshark or tcpdump show any traffic at all when trying to sniff.. Just my luck.
When you say reflash, you mean the SPI-NAND memory, right?

Right, I meant SPI-NAND. :frowning:

1 Like

The UART log "System halt!" means the BL2 is corrupted, you should use FLASH programmer to re-FLASH the entire NAND chip, that is the only way :frowning_face:

1 Like

FYI: this clip
https://a.aliexpress.com/_mMJcyYS with a CH341A programmer should do the job.

2 Likes

Installed openwrt according to official guide.
Badly need update, particularly:

  • Hyperlink for a quick telnet guide (yes I always forget every code after 2 days)
  • specifying that *.ubi / *.bin mean to download the specific file & renaming it.
  • how to upload files to router through telnet/ssh.
  • the command lines to install luci ui through telnet/ssh (and mentioning it needs active internet connection)

Here is a pic of testing wireless speed (on my phone) to my nas on official stock:

And here is the speed after flashing openwrt (same version as today on guide link) "160MHz, channel 100"

Same speed thankfully.

I'm very grateful for all the hard work of those who helped us.

I'm trying to install OpenWRT on my AX6000. Unfortunately, I cannot login to the router via ssh during step 4
After:
ubiformat /dev/mtd8 -y -f /tmp/initramfs-factory.ubi
reboot

Any suggestions on how to get ssh access?
initramfs-factory.ubi is the snapshot version, I hope? Or did I have to use another initramfs-factory?

update: MiWiFi repair tool saved my day. Router working again, will retry to flash OpenWRT later today.

update 2: root password:
on Ubuntu PC:
nano a.php
--> copy content https://raw.githubusercontent.com/YangWang92/AX6S-unlock/master/unlock_pwd.py into the file
python3 a.php {serial number router consisting of 2 numers and a /}
--> eg. like: python3 a.php 12345/12AB34567
password should now be printed on screen

To get initramfs-factory.ubi on my router:
cd /tmp
curl -L http://sebs.oss-cn-shanghai.aliyuncs.com/initramfs-factory.ubi -o initramfs-factory.ubi
reboot

OpenWRT url is 192.168.5.1
user: root password:password
Disconnect from network to prevent IP conflicts.

I have a problem.

When I use 36 channel, I am seeing a lot of errors "daemon.err hostapd: nl80211: kernel reports: integer out of range" in the log.

Wed Feb  8 23:54:15 2023 daemon.err hostapd: nl80211: kernel reports: integer out of range
Wed Feb  8 23:54:20 2023 daemon.err hostapd: nl80211: kernel reports: integer out of range
Wed Feb  8 23:54:21 2023 daemon.err hostapd: nl80211: kernel reports: integer out of range
Wed Feb  8 23:54:26 2023 daemon.err hostapd: nl80211: kernel reports: integer out of range
Wed Feb  8 23:54:27 2023 daemon.err hostapd: nl80211: kernel reports: integer out of range

Firmware Version: OpenWrt SNAPSHOT r22019-712681458a

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wmac+1'
        option band '5g'
        option cell_density '0'
        option he_bss_color '8'
        option he_su_beamformee '1'
        option htmode 'HE80'
        option country 'CN'
        option channel '36'
        option txpower '17'

config wifi-iface 'wifinet0'
        option device 'radio0'
        option mode 'ap'
        option ssid 'ABC123'
        option key '********'
        option network 'lan'
        option dtim_period '3'
        option ieee80211k '1'
        option bss_transition '1'
        option ieee80211r '1'
        option reassociation_deadline '20000'
        option ft_over_ds '0'
        option encryption 'psk2'
        option ft_psk_generate_local '1'
        option ieee80211w '1'
        option mobility_domain '9339'

Hi! Can anyone explain why this router does not support the 6GHz band? There is information online that suggests that both MT7976AN and MT7986A support 5/6GHz. Is it a hardware limitation for this specific device caused by the amplifiers, antennas or some other parts? Or is it just a configuration/driver issue?

Sorry if this question has been asked before, but I wasn't able to find any information on it.

1 Like

Thank you to @jav, @HZFrodo and @soxrok2212 for helping me on the path to recover my AX6000.
A colleague had a CH341A adapter (modded with 3V3 output) laying around from his previous BIOS adventures. Ended up soldering wires directly to the NAND chip and used the binaries that were posted last year by @lostinfever to fully recover my AX6000. Without this forum and its community, I'd be lost :slight_smile:

For others that find themselves with a corrupt bootloader, wrote this binary to my NAND flash:

CH341A SPI/EEPROM/NAND reader/writer, combined with this software:

1 Like

For starts its a Chinese device and 6GHz is not allowed in china. IIRC the FEM doesnt support 6GHz either.

1 Like

I finally got OpenWRT on my router.
The only problem now is the final step:
5. Flash sysupgrade.bin via sysupgrade
sysupgrade -n /tmp/squashfs-sysupgrade.bin

The file https://downloads.openwrt.org/snapshots/targets/mediatek/filogic/openwrt-mediatek-filogic-xiaomi_redmi-router-ax6000-stock-squashfs-sysupgrade.bin does not seem to work (incompatible; image check failed).

edit: error messages can be ignored (thanks @jav). I use X-Wrt for now as there does not seem to be a OpenWRT build with Luci and other important packages preinstalled.

If you're in stock layout, that'll be the right one. It shows an error, but flashes correctly anyway. Have you checked that it has rebooted with it (instead of initramfs)?

1 Like

Yes, I realize it is mainly a regulatory issue. But unless the wireless frontend really lacks support I am surprised that noone has tried to enable it yet

The hardware teardowns so far suggest that the rf components are not fit for 6 GHz use.