Add OpenWrt support for Xiaomi "Redmi AX6000"

For Developers
735

Look in the thread few days back, someone posted files from February which are working well.

736

There are new snapshots every day, is the bug fixed already?
The brick it created was fairly nasty, while only UART and one month old version could save the router.

1 Like
737

Finally, I built the snapshot, I reverted this commit and everything is working properly again.

Thank you so much for supporting me!

Greetings!

738

With the ubootmod, if I'm just installing the snapshot from the prebuilt snapshot downloads, do I need to worry about this issue @shauno100 had? can I just run:

opkg update && opkg install kmod-mtd-rw
insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1

Or can/should I get it from the downloads and install manually:

opkg install /tmp/kmod-mtd-rw_$(uname -r)+git-{number}-2_aarch64_cortex-a53.ipk
insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1

Thanks

739

Hello people,

unfortunately I have read the other posts only now.
I was able to flash one AX6000 at the end of February without any problems.
Now the second one arrived and I wanted to equip it with OpenWrt as well.
Unfortunately I am stuck in bootloop.

The MiWifi Repair Tool does not help me here.
I started the tool in a Win11 VM, because Windows wants to block the tool as Ransomeware.
The tool itself also runs tremendously unstable as it crashes all the time.

How can I rescue the router?
Luckily I have a Raspberry Pi 3B+ with display here, which I can use to connect to the router via UART.
I can also see the bootloop via that.
I just have no idea how best to proceed now.

For the record, I followed the installation instructions and got as far as installing OpenWrt via stock layout. After the reboot I had the bootloop.
I would quite like to use ubootmod.

UPDATE:

Managed to recover the router after all.
I don't know if it was due to my attempts to reload the original firmware or install the squashfs-sysupgrade, but I was now able to boot OpenWrt again with some detours.
I had to let firmware1 start via UART first, this returns to bootloop, then start firmware0 which also returns to bootloop (u-boot) and then I could let default load and got back into OpenWrt.

Very strange, but the router was then responsive again.

After that I was able to install ubootmod successfully.
(Snapshot from 17 March 2023)
The router now starts without problems every time with OpenWrt.

740

Hi,

I am also suffering a bootloop after doing a sysupdate a week ago. Right now I also tried to debrick my device through uart. But the link is dead in https://openwrt.org/toh/xiaomi/redmi_ax6000 for the initramfs-kernel.bin. Then I did use the xiaomi_redmi-router-ax6000-stock-initramfs-kernel.bin
But this ends in:

Using ethernet@15100000 device
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'initramfs-kernel.bin'.
Load address: 0x48000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########
         3.4 MiB/s
done
Bytes transferred = 7747868 (76391c hex)
Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK
Writing to MTD device 'nmbm0'... OK
OK

*** Loaded 7747868 (0x76391c) bytes at 0x48000000 ***

Run loaded data now? (Y/n): y

## Loading kernel from FIT Image at 48000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.15.102
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x480000ec
     Data Size:    3946971 Bytes = 3.8 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   19eb5baa
     Hash algo:    sha1
     Hash value:   dd9e7680a4250d5707265d5746df056fb3099434
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 48000000 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt xiaomi_redmi-router-ax6000-stock initrd
     Type:         RAMDisk Image
     Compression:  Unknown Compression
     Data Start:   0x483c3c14
     Data Size:    3765924 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   c0dd6860
     Hash algo:    sha1
     Hash value:   838649e1238dead741baa494e6940c87fb188c80
   Verifying Hash Integrity ... crc32+ sha1+ OK
WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
## Loading fdt from FIT Image at 48000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt xiaomi_redmi-router-ax6000-stock device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4875b3d4
     Data Size:    32768 Bytes = 32 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   b1b77c32
     Hash algo:    sha1
     Hash value:   ab3e4e1eb6d5675b7477266c63401e48abc57c62
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x4875b3d4
   Uncompressing Kernel Image
lzma compressed: uncompress error 1
Must RESET board to recover
resetting ...

I also tried the MiWifi Repair Tool, which also ended with some error on the device itself, red blinking leds. Any help how to recover the device is appreciated. I did keep the original flash layout.

741 
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'initramfs-kernel.bin'.

You are running XiaoMi OEM recovery from PC IP: 192.168.31.100 to 192.168.31.1 (XiaoMi's router IP), so you need to use an OEM firmware for the recovery process. You get this error because XiaoMi is expecting an OEM firmware but not Openwrt firmware.

Openwrt TFTP recovery process will use 192.168.1.xxx to send file to 192.168.1.1 (router IP)

742

If I do load the Xiaomi OEM firmware it ends even earlier:


  *** U-Boot Boot Menu ***

     1. Startup system (Default)
     2. Startup firmware0
     3. Startup firmware1
     4. Upgrade firmware
     5. Upgrade ATF BL2
     6. Upgrade ATF FIP
     7. Upgrade single image
     8. Load image
     0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit

*** Loading image ***

Input load address: 0x48000000

Available load methods:
    0 - TFTP client (Default)
    1 - Xmodem
    2 - Ymodem
    3 - Kermit
    4 - S-Record

Select (enter for default):

Input U-Boot's IP address: 192.168.31.1
Input TFTP server's IP address: 192.168.31.100
Input IP netmask: 255.255.255.0
Input file name: miwifi_rb06_firmware_847e9_1.0.48.bin

Using ethernet@15100000 device
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'miwifi_rb06_firmware_847e9_1.0.48.bin'.
Load address: 0x48000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ################################################################
         8.7 MiB/s
done
Bytes transferred = 20972472 (14003b8 hex)
Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK
Writing to MTD device 'nmbm0'... OK
OK

*** Loaded 20972472 (0x14003b8) bytes at 0x48000000 ***

Run loaded data now? (Y/n): y

"Synchronous Abort" handler, esr 0x96000004
elr: 0000000041e6b974 lr : 0000000041e6cc9c (reloc)
elr: 000000005ff9d974 lr : 000000005ff9ec9c
x0 : eafffffeea000008 x1 : eafffffeea000007
x2 : eafffffeea000008 x3 : 00000000ffffffff
x4 : 00000000ffffffff x5 : 0000000000000000
x6 : 00000000ffffffd0 x7 : 0000000000000010
x8 : 000000000000000d x9 : 0000000000000008
x10: 00000000ffffffd8 x11: 0000000000000006
x12: 000000000001869f x13: 0000000000000012
x14: 0000000000000001 x15: 00000000ffffffff
x16: 0000000000000000 x17: 0000000000000000
x18: 000000005f7ffdb0 x19: eafffffeea000008
x20: 00000000ffffffff x21: 000000005f7fd3ef
x22: 000000005f7fd7ef x23: 0000000000000000
x24: 000000005f7fd3d8 x25: 000000005ffb1cde
x26: 00000000ffffffff x27: 0000000000000000
x28: 000000005f7fd7ef x29: 000000005f7fd230

Code: 8b010001 aa0003e2 eb01005f 54000060 (39400043)
Resetting CPU ...

resetting ...

I tried to follow the debrick instructions from the wiki:
Assume that you have installed OpenWrt with stock layout, with original u-boot:

  • Connect to router via UART

  • Select Load Image in the u-boot

  • Set start address to 0x48000000, then set TFTP parameters to load the initramfs-kernel.bin.

  • Start the loaded kernel, then perform sysupgrade on OpenWrt.

And there I was under the impression I need to load the openwrt firmware.

743

Yes, you need to use the OpenWRT firmware. Issue is that the latest versions have a bug that prevents them to run, so you need to locate an older image that works fine.

See, for instance, these ones:

744

Have you tried what I wrote?
So first 3, then 2, then 1?
I was able to boot back into OpenWrt and install ubootmod.

I had the same problem and when I tried to install the original firmware, the router only blinked after downloading the firmware.

745

Yes tried, first 3, then 2, then 1? but no joy.

746

Hmm I cannot find really where I can still download it. Do you maybe have a mirror or such?

747

I don't, but looks like in the GDrive link from the message I quoted they're still available.

748

The release for 02/03 has no openwrt-mediatek-filogic-xiaomi_redmi-router-ax6000-stock-initramfs-kernel.bin and the 02/20 has the same issue with the lzma. So cannot really get anything to work.

749

The fix has supposedly been merged.

Can anyone with stock layout and UART test the latest snapshot?

3 Likes
750

It was very easy to do the installation, following the steps in the wiki and from @jav

It would be nice to update a couple steps in the wiki:

  • Add step about enabling SSH access should mention passwd
  • scp step: xiaomi_redmi-router-ax6000-stock-initramfs-kernel.bin should be openwrt-mediatek-filogic-xiaomi_redmi-router-ax6000-stock-initramfs-factory.ubi
1 Like
751

If you want luci, note you can go to:

And enter luci in "Customize installed packages" to get a SNAPSHOT build with luci

752

Done! Thanks.

1 Like
753

Tested. At least it boots and working! Build - r22344-ca330cac92.

754

Buuut on next day router hangs, and now don't establish wifi connection. WED and HW, SW flow offloading turning off don't make a difference.

Update!! Nope, all good. I just ruined dnsmasq, build pretty stable.