Add support for Xiaomi AX1800 Wifi 6 router

@Gingernut, @rudra2020
AX5 (DVB4252CN) system boots from 0 (mtd18)

root@XiaoQiang:~# nvram get flag_boot_rootfs
0

seems need to flash 1 (mtd19)

root@XiaoQiang:~# cat /proc/mtd | grep root
mtd18: 02400000 00020000 "rootfs" - is the 0
mtd19: 02400000 00020000 "rootfs_1" - is the 1
mtd23: 0156f000 0001f000 "ubi_rootfs"
mtd24: 006e7000 0001f000 "rootfs_data"

List of all partitions:

root@XiaoQiang:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00180000 00020000 "0:SBL1"
mtd1: 00100000 00020000 "0:MIBIB"
mtd2: 00380000 00020000 "0:QSEE"
mtd3: 00080000 00020000 "0:DEVCFG"
mtd4: 00080000 00020000 "0:RPM"
mtd5: 00080000 00020000 "0:CDT"
mtd6: 00080000 00020000 "0:APPSBLENV"
mtd7: 00180000 00020000 "0:APPSBL"
mtd8: 00080000 00020000 "0:ART"
mtd9: 00080000 00020000 "bdata"
mtd10: 00080000 00020000 "crash"
mtd11: 00080000 00020000 "crash_syslog"
mtd12: 00080000 00020000 "0:BOOTCONFIG"
mtd13: 00080000 00020000 "0:BOOTCONFIG1"
mtd14: 00380000 00020000 "0:QSEE_1"
mtd15: 00080000 00020000 "0:DEVCFG_1"
mtd16: 00080000 00020000 "0:RPM_1"
mtd17: 00080000 00020000 "0:CDT_1"
mtd18: 02400000 00020000 "rootfs"
mtd19: 02400000 00020000 "rootfs_1"
mtd20: 024a0000 00020000 "overlay"
mtd21: 00080000 00020000 "cfg_bak"
mtd22: 003a2000 0001f000 "kernel"
mtd23: 0156f000 0001f000 "ubi_rootfs"
mtd24: 006e7000 0001f000 "rootfs_data"
mtd25: 02093000 0001f000 "data"

I'm right?

So you need to flash to mtd19 and then switch to that partition with the nvram commands.

root@XiaoQiang:~# ubiformat /dev/mtd19 -f /tmp/openwrt-ipq60xx-generic-glinet_gl
-ax1800-squashfs-nand-factory.ubi -s 2048 -O 2048
ubiformat: mtd19 (nand), size 37748736 bytes (36.0 MiB), 288 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 287 -- 100 % complete
ubiformat: 288 eraseblocks have valid erase counter, mean value is 8
ubiformat: flashing eraseblock 205 -- 100 % complete
ubiformat: formatting eraseblock 287 -- 100 % complete
root@XiaoQiang:~# nvram set flag_last_success=1
root@XiaoQiang:~# nvram set flag_boot_rootfs=1
root@XiaoQiang:~# nvram commit
root@XiaoQiang:~# reboot

I flashed OpenWRT for GL.iNet AX1800 and caught the orange diode (does not boot up).
Step 6 of manual was skipped for the reason above.
Restored via MIWIFIRepairTool.x86
Guys any suggestion are welcome =)

It's more than likely because Coolsnowolf's code actually doesn't have support for the Xiaomi AX1800.

1 Like

Hi @robimarko and @f00b4r0.
I found Xiaomi AX1800 Device DTS - qcom-ipq60xx-cpxx.dts IPQ6018/AP-CP02-C1

We also have DTS from @coolsnowwolf

and his ipq60xx tree https://github.com/coolsnowwolf/lede/tree/master/target/linux/ipq60xx

I know that ath11k might have issues running with 256mb memory, but on the lightweight OpenWRT fw we can try to run this and test it.

Regards,
Blaze

2 Likes

Guys, please dont tag me with stuff like this.
That coolsnowwolf has nothing to do with OpenWrt, it was explained multiple times.

Also, dont hold your breath with 256MB boards, thats essentially e-waste as soon it was manufactured

Sorry. A new topic in LEDE repo https://github.com/coolsnowwolf/lede/issues/8659

I noticed something the day I got this router. with this router my pings are bit higher.

This is with RA67 running latest CN firmware, locale CN
cmd_ezulak1LK8

This is with Xiaomi 4a gigabit running latest CN firmware, locale CN
cmd_E9hpB3h5XJ

It is not much difference but there is difference.

Both are on same ISP and connected by cat5e cable.

I wouldn't say that this router is e-waste, there's a lot that can be done with it even with the default firmware.

I bought the global version on amazon for 40 euros, installed the chinese fw to get ssh access, then installed the patched global fw (a few posts above) to get permanent ssh and increased power. I followed some instructions to get opkg working (did setup udpxy, adblock, nano, other stuff), build userspace wireguard-go (still having issues creating the routes, work in progress) and I have pretty much all that I needed from an openwrt router. (I will gather my notes if anyone is interested)

It's true that the packages may be a bit outdated (I don't know if there are some known vulnerabilities, you may check what you install), there is no Luci (for now?) and I still need to disable the chinese services, but for not that much money and some work you get a very capable router (great wifi, quite some cpu power, still some free ram 55MB free + 30MB cached for me, openwrt capable with limitations).
The AX3600 might be a better buy as it can run native openwrt with ath11k, has more wifi, but it's more than double the price and was for me hard to justify given that we already had wifi working with the ISP box in my household... (and the design is a bit more 'aggressive')

6 Likes

Hi there! Would you mind sharing your config for opkg? Because I've tried to install nano and the current packages doesn't work with the core packages included in Xiaomi's firmware.
Thanks!

Yes sure!

in /etc/opkg/distfeeds.conf

src/gz openwrt_core http://downloads.openwrt.org/releases/18.06-SNAPSHOT/targets/ipq40xx/generic/packages
src/gz openwrt_base http://downloads.openwrt.org/releases/18.06-SNAPSHOT/packages/arm_cortex-a7_neon-vfpv4/base
src/gz openwrt_packages http://downloads.openwrt.org/releases/18.06-SNAPSHOT/packages/arm_cortex-a7_neon-vfpv4/packages
src/gz openwrt_routing http://downloads.openwrt.org/releases/18.06-SNAPSHOT/packages/arm_cortex-a7_neon-vfpv4/routing

changed the packages priorities in /etc/opkg.conf (add these at the end)

arch all 1
arch noarch 1
arch arm_cortex-a7 10
arch arm_cortex-a7_neon-vfpv4 20

You'll then be able to install packages, but they might not work as you need to add a link to the libc library

ln -s /lib/libc.so /lib/ld-musl-armhf.so.1

Then you should be good to go.

To build wireguard-go, I installed on another linux machine the go framework, and then build the binary using:

env GOOS=linux GOARCH=arm go build

I was able to scp the wireguard binary to the ax1800 and use it to create tunnels, I'm just now having troubles properly configure everything around it (you might have to opkg install wireguard-tools to have the wg command available)

1 Like

To me it's the definition of e-waste, you are gonna be stuck with the same completely outdated 4.4.60 kernel, and the userspace that is even older.
I don't know which one of these facts is worse, kernel has exploits for sure but the userspace would probably be a nice CVE list generator.

Xiaomi basically doesn't ever update these (Well any of its router) devices, they issue 1-2 FW updates when it launches and that's it, even when they update its still ancient QSDK(We are talking multiple versions behind already outdated QCA stuff) and put a ton of their crazy services on top.

So to me, any vendor crap like this is e-waste as it's kind of crazy to use it in firewalled networks, not to mention actually using it a the gateway.

To me, the chopped-up Redmi AX6 is a better buy, especially because of RAM and much better radios.
IPQ6000 is just an allusion of 802.11ax, it's quite literally the lowest specs they could do, its IPQ6010/18 silicon that failed validation and they knocked the clocks down further.
Any decent 4x4 802.11ac AP will beat it in performance.

3 Likes

This worked great!

I was having trouble trying to execute "nano" and the solution was to link the libc libreary.

I can't say I disagree with what you say, it's really a pitty the hardware is this artificially limited by the s**tty software support...

Also I can't seem to find the AX6 anywhere anymore (or at the price of the AX3600?). It seems to have been replaced by the AX6S (mediatek chip with 256MB ram, I'm not sure what it's worth) or AX3000 (seems even worse than AX1800/AX5 with its dual code IPQ5000 and still 256MB ram).

Back to the AX1800, I used the cleanup commands found there to remove some xiaomi services, and was able to setup properly wireguard-go (the key was to force-install a recent openwrt version of wireguard-tools despite the kernel version warning because the 18.06 version of wg tool hangs when doing 'wg setconf ...', and modify the /lib/netifd/proto/wireguard.sh script to create the interface using our userspace 'wireguard' command instead of 'ip add dev ... proto wireguard').

1 Like

The AX6S seems to be getting oficial support somewhere down the road and is supposed to be a good buy.

If you keep your eyes open and interested you can find the AX3600 on Amazon used for 50โ‚ฌ like did.

ipq60xx: disable build for unsupported devices

Hi everyone, my AX5 got bricked and can't TTL, so I have to flash it with the programmer. However, I don't have the mtd full backup, anyone please help me to make the backup of stock mtd, then I can unbrick my router. Thank you very very much!

Utility SNANDer allows you to partially write data into flash memory.

I known that, but my router has been bricked, so I can not make backup from it!

What exactly is it that you did and how exactly does it now behave?

Why exactly can't it TTL? I assume you mean the serial console by that, correct?

Anyway, only if you reveal more details about stuff can people help you better and also others can profit from solutions suggested :wink:.

1 Like