Add OpenWrt support for Xiaomi "Redmi AX6000"

Making it more explicit which files to upload to the router and how to upload them using scp.

Eg my mistake of uploading the ubootmod-squashfs-sysupgrade.itb image instead of stock-squashfs-sysupgrade.bin.

The instructions only say:

 5. Flash sysupgrade.bin via sysupgrade

sysupgrade -n /tmp/squashfs-sysupgrade.bin

I'm not being critical, it was definitely my mistake.

But I was doing the stock install and the link just above that is called "Sysupgrade image", and that one links to the ubootmod image. That's why I used the wrong one and bricked my router.

Just it seems a lot of people have bricked their routers and had to recover in this thread, so hoping to avoid that.

So I would change it to:

  1. Flash sysupgrade.bin via sysupgrade:

Download stock-squashfs-sysupgrade image from here.

Then copy that to the router using scp:

scp openwrt-23.05.3-mediatek-filogic-xiaomi_redmi-router-ax6000-stock-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/stock-squashfs-sysupgrade.bin

Then flash the image:

sysupgrade -n /tmp/stock-squashfs-sysupgrade.bin

Just so people can copy/paste easier.

I would also add the explicit link and the scp info at step 3 of installing the stock image in the same way as well.

Also Step 2 is a bit weird?

else if current system is ubi

Should that be ubi0? Because earlier it was only talking about ubi1 and ubi0.

I don't really understand that part too much, I found that whole part slightly confusing but not too difficult. Maybe ideally it could become a small script that uses the value from /proc/cmdline automatically in the commands, so you can just copy/paste the command? Not a big deal though.

It's awesome work to get it hacked and working! Thanks again!

Yes but I didn't want to run a janky program in a language I can't read that sets off every antivirus known to man.

I know it's probably ok, but I'm happier about using Tftpd64, so just throwing the info out there for anyone else who might feel the same.

I understand you. The fact that you immediately installed ubootmod was a mistake, but if you had continued following the installation instructions for wrt-ubootmod, you would have gotten a faster router with 30% more disk space.

I just stuck with stock layout because of the huge time sink because I messed up and had to unbrick it.

How worth it is it to go to ubootmod layout? Noticeably faster? I don't really care about space that much, it's really just an AP for me at the moment.

What about unbricking? Is that easier or harder with ubootmod layout?

Are people able to set the channel number on 5GHz wifi when in AX 80MHz mode?

Mine only seems to work when the channel is set to "Auto". Otherwise it just stays disabled.

I was trying to use the Status-Channel Analysis to pick a free channel, but I couldn't get it to work.

Hi guys!

Made a terrible mistake here. In the step where I was supposed to flash initramfs-factory, I flashed initramfs-uboot.

Can someone advise what should I do or is my router dead? I am able to login via ssh but everytime it will reset

Did you define your country for the country code? I believe the default is 'global' which is not right.

If your router is booting fine from the initramfs image you have loaded (ssh works, but you're unable to save anything), you can continue from step 4 of the ubootmod layout installation:

Installing OpenWrt (ubootmod layout)

I'd recommend saving the system partition images (step 2 of that section) before anything else, just in case.

lan -> wifi no hw offloading..
wan -> wifi hw offloading is no problem..
@jkdf2

Hello,
Little warning for new comers. I got "tricked" as well by the tuto. The problem is that the links to download firrmwares go to ubootmod files instead of stock factory.ubi.
Then you at stuck and with a soft brick. I will try to unbrick in couple days. (I tried to ubiformat /dev/mtd5 -y -f /tmp/initramfs-factory.ubi, on mtd5 instead of 8. Don't do it :frowning:

1 Like

I do confirme I was able to unbrick it with MiWifiRepairtool and then to fully switch to OpenWrt.
However, I would recommand the following editions to the wiki :

  1. Replace

Now start the daemon: /etc/init.d/dropbear start
If needed (by default it's empty), root password can be changed typing passwd

by

Now start the daemon: /etc/init.d/dropbear start
If needed (by default it's empty), root password can be changed typing passwd with Telnet

  1. Modify

It should also be noted that users of a modern ssh package will need to append the -O flag to invocations of scp in order to get it to use the legacy protocol.

by

It is needed to transfer the firmware to the router in /tmp with the use of scp command or similar tool.
It should also be noted that users of a modern ssh package will need to append the -O flag to invocations of scp in order to get it to use the legacy protocol.
% scp -O openwrt-mediatek-filogic-xiaomi_redmi-router-ax6000-stock-initramfs-factory.ubi root@192.168.31.1:/tmp

  1. More important. To change the links for firmwares. Either with direct links to "stock" firmwares or to the main folder and to guide to the right file.

Then the tuto is working great to unlock this router.
Thank you to the developpers

  1. Noticeably faster.
  2. If you “donate” 10 MB of space, which will still be more than the stock, and install the recovery firmware, it’s very simple. If you don’t install, then also download the same recovery firmware into the router’s memory via TFTP and flash the usual firmware through Luci.

I did try and still manually setting a channel didn't work.

I just noticed, my OpenWRT stock layout is now:

root@OpenWrt:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "BL2"
mtd1: 00040000 00020000 "Nvram"
mtd2: 00040000 00020000 "Bdata"
mtd3: 00200000 00020000 "Factory"
mtd4: 00200000 00020000 "FIP"
mtd5: 00040000 00020000 "crash"
mtd6: 00040000 00020000 "crash_log"
mtd7: 01e00000 00020000 "ubi_kernel"
mtd8: 05000000 00020000 "ubi"

But the guide says it should be:

dev 	start 	end 	size 	erasesize 	name 	size
mtd0 	00000000 	00100000 	00100000 	00020000 	BL2 	1MiB
mtd1 	00100000 	00140000 	00040000 	00020000 	Nvram 	256KiB
mtd2 	00140000 	00180000 	00040000 	00020000 	Bdata 	256KiB
mtd3 	00180000 	00380000 	00200000 	00020000 	Factory 	2MiB
mtd4 	00380000 	00580000 	00200000 	00020000 	FIP 	2MiB
mtd5 	00580000 	005c0000 	00040000 	00020000 	crash 	256KiB
mtd6 	005c0000 	00600000 	00040000 	00020000 	crash_log 	256KiB
mtd7 	00600000 	02400000 	01E00000 	00020000 	ubi 	30MiB
mtd8 	02400000 	04200000 	01E00000 	00020000 	ubi1 	30MiB
mtd9 	04200000 	07400000 	03200000 	00020000 	overlay 	50MiB 

The last few are different.

Is this anything to worry about or are the docs out of date?

0x1E + 0x50 = 0x6E
0x1E + 0x1E + 0x32 = 0x6E

? I don't understand. I think you're saying that they're actually the same but I see a "ubi_kernel" "ubi1" and "overlay" that aren't listed.

Anyway, whatever, the thing is working.

OpenWrt 23.05.3 works fine on my AX6000. No issues.

1 Like

HI All,

I have done a fair amount of reading and im pretty sure if have bricked the device. I have uart access and when i reboot the device no leds come on, nothing seems to happen and uart says "system halt!".

Was wondering if a few of the much more knowledgable people than me might cast an eye over it.

Many thanks in advance,
wraypa1

i append the uart logs from when it all went wrong...

Hit any key to stop autoboot: 0
detect button reset released!
Reading from 0x0 to 0x5f7ff2dc, size 0x4 ... OK
Boot failure detected on both systems
Reading from 0x0 to 0x5f7ff2dc, size 0x4 ... OK
Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK
Writing to MTD device 'nmbm0'... OK
OK
Booting System 1
ubi0: attaching mtd10
ubi0: scanning is finished
ubi0: attached mtd10 (name "ubi1", size 30 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 240, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 217, total reserved PEBs: 23, PEBs reserved for bad PEB handling: 19
Reading from volume 'kernel' to 0x46000000, size 0x0 ... *** Cannot find volume 'kernel' ***
resetting ...

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
F5: 1026 0000
00: 1005 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
01: 102A 0001
02: 1005 0000
BP: 2000 00C0 [0001]
EC: 0000 0000 [1000]
T0: 0000 00BB [010F]
System halt!

can you get into recovery mode? unplug, hold reset button, plug in.

The bootloader is deleted or corrupted in your case.

if you have taken an entire backup for the flash and you have a programmer / cable set to recover the flash then you might be able to get the router to work again