Add support for Xiaomi AX1800 Wifi 6 router

divinecougar · March 14, 2024, 7:28am

no im sorry. I will have to buy a new one

divinecougar · March 15, 2024, 10:51am

Should I use 1.8w?

proxer05 · March 15, 2024, 10:53am

Yes. It's using 1.8v logic.

divinecougar · March 16, 2024, 9:41pm

hello

I bought a uart adapter. I used it with tera term. The device gives the following logs at startup.

jude · April 3, 2024, 12:48pm

abm1982 · April 4, 2024, 10:27am

I have the AX1800 black tower. After turning it off, the blue light will no longer return. I did the whole process with the miwifi tool and was unsuccessful. I tried with the three available firmware. The recovery process occurs normally, with the blue light flashing, but when you restart the router the orange light returns. I left it on for over an hour with the orange light and it turned blue after that time, but when I restart it it comes back to orange. Is there anything that can be done?

proxer05 · April 4, 2024, 10:30am

You can try this method(but make sure partition addresses are correct) Add support for Xiaomi AX1800 Wifi 6 router - #410 by proxer05

abm1982 · April 4, 2024, 10:37am

Thank you for your fast reply. I will try this and returns

abm1982 · April 4, 2024, 10:39am

How to discover correct partition from my model?

proxer05 · April 4, 2024, 10:41am

In boot logs you should have partition table(I assume that you have uart adapter)

abm1982 · April 4, 2024, 10:44am

No man, i dont have this uart adapter =(

quim · April 8, 2024, 11:32pm

help Install openwrt Xiaomi Router AX1800 wifi 6 (AX5/RA67) .

janeblower · April 17, 2024, 12:37pm

Successfully restored bootloader via USB and Uart.

download software from GL manual/install drivers (disable driver signature verification)
connect usb to pc
connect power

QSaharaServer.exe -p \\.\COM4 -s 13:xbl.elf -v 3
QsaharaServer.exe -p\ \.\COM4 -s 1:cdt.bin -s 34:devcfg.bin -s 5:uboot.bin -v 3

After that, it is possible to connect to TTL:

dhcp uboot.bin
nand write 0x44000000 0x800000 0x180000

I used the "dhcp" command because it is spelled shorter

That should have been enough, but not in my case:
80%+ of the nand blocks were bad.

nand scrub 0x0 "last bad block address - for me 0x4840000" (this will **ERASE** the nand)

Next I had to take the basic MTD (mtd0-mtd17) from a healthy router.
repeat for every mtd:

dhcp mtdX.bin
nand write 0x44000000 "mtd address" "mtd size"

Finaly, i was able to reboot and upload the firmware (factory) via the web interface.

divinecougar · April 27, 2024, 12:23pm

I also destroyed a device. I sold it in broken condition. Be careful when installing Openwrt, you may damage the device irreversibly.

rudra2020 · August 13, 2024, 6:43pm

does wifi work? how can i install it?

rudra2020 · August 13, 2024, 7:07pm

i have come across this, this seem to have build for ax5. i don't know how to install tho

janeblower · September 27, 2024, 9:27pm

How to OpenWrt?

This is a translation of my post from the russian forum. (via google translator): https://4pda.to/forum/index.php?showtopic=995699&view=findpost&p=132386156

This is not a call to action, if after reading below you decide to do something, then you take responsibility for crooked hands.
!!!Make backups!!!

What about OpenWRT for this router?

OpenWRT for the router exists, but there is a nuance.
Without upgrading the RAM, Wi-Fi will not work.

Ready-made firmware can be taken here: https://github.com/breeze303/openwrt-ci
I do not recommend - the author included many things in the firmware that he personally needs (all sorts of utilities and things to bypass censorship in China).

Build it yourself: https://github.com/LiBwrt-op/openwrt-6.x
With the default config for this device, the firmware did not start for me.
I copied the build config from the first repository, and then manually disabled everything that I personally did not need, and added the kmods I needed.
(I will not give my config, if this is a problem for you, then you do not need OpenWRT.)

The process of switching to OpenWRT is described below, do everything in order.

RAM upgrade

This will require the following:

RAM chip of 512 MB or higher.

Guaranteed compatible chips

Original: M15T2G16128A-DEB
2GB:
MT41K1G16DGA-125:A (D9STR)
1GB:
MT41K512M16HA-125:A (D9STQ)
MT41K512M16VRP-107 IT:P (D9ZWN)
512M:
MT41K256M16TW-107 AIT:P (D9SHJ)
MT41K256M16TW-107:P (D9SHG)

P.S. I installed D9STQ

Straight hands and a soldering station, or ~1k rubles for a trip to a service center.
CDT config (mtd5) for the required amount of RAM, without it the system will only work with 256 MB of RAM, regardless of the installed chip.

Where to get CDT

Ready binaries for 512 MB/1 GB: https://github.com/janeblower/redmi_ax1800-ax5-ra67/tree/main/CDT
Build it yourself: https://github.com/lu-…t-gpt-ipq60xx-generate

Procedure:

Replace the old memory chip with a new one.
Flash CDT and reboot:

# As far as I remember, the factory firmware does not allow writing CDT of the active partition, you will probably need to flash one partition first, reboot into another slot and flash another partition.
# There are definitely no such restrictions in the transition firmware
# Slot 1
mtd erase /dev/mtd5
mtd write /tmp/CDT-AX5_1G.bin /dev/mtd5
mtd verify /tmp/CDT-AX5_1G.bin /dev/mtd5
# Slot 2
mtd erase /dev/mtd17
mtd write /tmp/CDT-AX5_1G.bin /dev/mtd17
mtd verify /tmp/CDT-AX5_1G.bin /dev/mtd17```

Intermediate (transition) firmware

It is necessary to perform other points, there is no other way.

Download the firmware and unzip it in /tmp (https://github.com/janeblower/redmi_ax1800-ax5-ra67/tree/main/transitional%20firmware)
nvram get flag_boot_rootfs

If returned 1

nvram set flag_last_success=0
nvram set flag_boot_rootfs=0
nvram set flag_boot_success=1
nvram set flag_try_sy s1_failed=0
nvram set flag_try_sys2_failed=0
nvram set boot_wait=on
nvram set uart_en=1
nvram set telnet_en=1
nvram set ssh_en=1
nvram commit
ubiformat /dev/mtd18 -y -f /tmp/factory.ubi
reboot

If returned 0

nvram set flag_last_success=1
nvram set flag_boot_rootfs=1
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram set boot_wait=on
nvram set uart_en=1
nvram set telnet_en=1
nvram set ssh_en=1
nvram commit
ubiformat /dev/mtd19 -y -f /tmp/factory.ubi
reboot

The router address is now 192.168.1.1, login: root / password: password

UBoot and Mibib (partition table)

Why?
Without changing the markup, most likely, OpenWRT simply will not fit into the standard small partitions.
I recommend that you read in advance my experience with UBoot recovery, which I described earlier: Add support for Xiaomi AX1800 Wifi 6 router - #453 by janeblower

There is a choice of 3 UBoot/Mibib (they only work in pairs)

You can try to build the sections yourself.
Uboot: https://github.com/0x5826/uboot-ipq60xx-build
It is not quite for our router, so you will have to edit the source code if you decide to.
Mibib (GPT): https://github.com/lu-…t-gpt-ipq60xx-generate
Provides less free space than the second option: https://github.com/janeblower/redmi_ax1800-ax5-ra67/tree/main/uboot/coolsnowwolf
Original: https://mbd.pub/o/bread/Ypqbk5dr
Provides more free space than the first option:https://github.com/janeblower/redmi_ax1800-ax5-ra67/tree/main/uboot/darkcloud
Original: https://mbd.pub/o/bread/mbd-Y5aUlpxx
Installation is described in the links to the original, Google translator to help.

Installing your version of OpenWRT

Connect the router to the PC
Assign the PC (in your Windows settings) a static IP 192.168.1.2 with a mask of 255.255.255.0
Turn off the router's power.
Press and hold the reset button and connect the power.
After holding the reset button for a few seconds, the boot will be interrupted and the U-Boot web interface will be launched (the router's LED will signal the transition to the desired mode (each U-Boot has its own signal))
Open http://192.168.1.1 in the browser, download the firmware with the extension .ubi and confirm the update.

Done!
After installation, the package repositories will be Chinese, I use this mirror:

src/gz openwrt_base https://mirrors.cicku.me/openwrt/snapshots/packages/aarch64_cortex-a53/base
src/gz openwrt_luci https://mirrors.cicku.me/openwrt/snapshots/packages/aarch64_cortex-a53/luci
src/gz openwrt_packages https://mirrors.cicku.me/openwrt/snapshots/packages/aarch64_cortex-a53/packages
src/gz openwrt_routing https://mirrors.cicku.me/openwrt/snapshots/packages/aarch64_ cortex-a53/routing
src/gz openwrt_telephony https://mirrors.cicku.me/openwrt/snapshots/packages/aarch64_cortex-a53/telephony

Afterword:
Some of the information is taken from a Chinese forum, I recommend you read it: https://www.right.com.cn/forum/forum-171-1.html
If suddenly the specified repositories are deleted from GitHub, you can use my unmodified forks: https://github.com/janeblower?tab=repositories
All files required for flashing from spoilers: https://github.com/janeblower/redmi_ax1800-ax5-ra67

Screenshot of the main page of my OpenWRT:

ajj · October 18, 2024, 1:51pm

Why does this router need more ram when some WiFi 6 devices run okay with openwrt with 256mb of RAM?

proxer05 · October 18, 2024, 1:55pm

These devices are based on mediatek SoC and their driver uses less ram. Ath11k which Qualcomm wifi6 devices use in theory can run on 256mb but currently 512mb is minimum to run it with working wifi.

janeblower · October 18, 2024, 2:08pm

https://file-cn.52pika.cn/Sources/OSMirror/Router/NWRT/Redmi-AX5-AX1800
I found openwrt with wifi here that runs on 256mb RAM (I tested).
Unfortunately, there is no source code > kmod's are not available.

Minimal version kmod's list

root@Nwrt:~# opkg list | grep kmod
kmod-arptables - 5.4.164-1
kmod-asn1-decoder - 5.4.164-1
kmod-bootconfig - 5.4.164+1-1
kmod-br-netfilter - 5.4.164-1
kmod-button-hotplug - 5.4.164-3
kmod-cfg80211-linux - 5.4.164-1
kmod-crypto-crc32c - 5.4.164-1
kmod-crypto-hash - 5.4.164-1
kmod-diag-char - 5.4.164+1-1
kmod-gpio-button-hotplug - 5.4.164-3
kmod-input-core - 5.4.164-1
kmod-ip6tables - 5.4.164-1
kmod-ipt-conntrack - 5.4.164-1
kmod-ipt-conntrack-extra - 5.4.164-1
kmod-ipt-core - 5.4.164-1
kmod-ipt-extra - 5.4.164-1
kmod-ipt-filter - 5.4.164-1
kmod-ipt-fullconenat - 5.4.164+2022-02-13-108a36cb-10
kmod-ipt-ipopt - 5.4.164-1
kmod-ipt-nat - 5.4.164-1
kmod-ipt-nathelper-rtsp - 5.4.164+2.14-9
kmod-ipt-offload - 5.4.164-1
kmod-ipt-physdev - 5.4.164-1
kmod-ipt-raw - 5.4.164-1
kmod-ipt-sctp - 5.4.164-1
kmod-ipt-tproxy - 5.4.164-1
kmod-iptunnel - 5.4.164-1
kmod-leds-gpio - 5.4.164-1
kmod-lib-crc-ccitt - 5.4.164-1
kmod-lib-crc32c - 5.4.164-1
kmod-lib-textsearch - 5.4.164-1
kmod-macvlan - 5.4.164-1
kmod-nf-conntrack - 5.4.164-1
kmod-nf-conntrack6 - 5.4.164-1
kmod-nf-flow - 5.4.164-1
kmod-nf-ipt - 5.4.164-1
kmod-nf-ipt6 - 5.4.164-1
kmod-nf-nat - 5.4.164-1
kmod-nf-nathelper-extra - 5.4.164-1
kmod-nf-reject - 5.4.164-1
kmod-nf-reject6 - 5.4.164-1
kmod-nls-base - 5.4.164-1
kmod-ppp - 5.4.164-1
kmod-pppoe - 5.4.164-1
kmod-pppox - 5.4.164-1
kmod-qca-cnss - 5.4.164+g3426585-dirty-1
kmod-qca-mcs - 5.4.164+g3426585-dirty-1
kmod-qca-nss-dp - 5.4.164+g3426585-dirty-1
kmod-qca-nss-drv - 5.4.164+g3426585-dirty-2
kmod-qca-nss-drv-bridge-mgr - 5.4.164+g3426585-dirty-2
kmod-qca-nss-drv-pppoe - 5.4.164+g3426585-dirty-2
kmod-qca-nss-drv-vlan-mgr - 5.4.164+g3426585-dirty-2
kmod-qca-nss-ecm-standard - 5.4.164+g3426585-dirty-1
kmod-qca-nss-macsec - 5.4.164+g3426585-dirty-1
kmod-qca-ssdk-nohnat - 5.4.164+g3426585-dirty-1
kmod-qca-wifi-lowmem-profile - 5.4.164+g3426585-dirty-1
kmod-slhc - 5.4.164-1
kmod-udptunnel4 - 5.4.164-1
kmod-udptunnel6 - 5.4.164-1
kmod-usb-core - 5.4.164-1
kmod-usb-dwc3-internal - 5.4.164+1-1
kmod-usb-dwc3-qcom-internal - 5.4.164+1-1
kmod-usb-gadget - 5.4.164-1
kmod-vxlan - 5.4.164-1

Largest version kmod's list

kmod-arptables - 5.4.164-1
kmod-asn1-decoder - 5.4.164-1
kmod-bonding - 5.4.164-1
kmod-bootconfig - 5.4.164+1-1
kmod-br-netfilter - 5.4.164-1
kmod-button-hotplug - 5.4.164-3
kmod-cfg80211-linux - 5.4.164-1
kmod-crypto-crc32c - 5.4.164-1
kmod-crypto-hash - 5.4.164-1
kmod-diag-char - 5.4.164+1-1
kmod-gpio-button-hotplug - 5.4.164-3
kmod-inet-diag - 5.4.164-1
kmod-input-core - 5.4.164-1
kmod-ip6tables - 5.4.164-1
kmod-ipt-conntrack - 5.4.164-1
kmod-ipt-conntrack-extra - 5.4.164-1
kmod-ipt-core - 5.4.164-1
kmod-ipt-extra - 5.4.164-1
kmod-ipt-filter - 5.4.164-1
kmod-ipt-fullconenat - 5.4.164+2022-02-13-108a36cb-10
kmod-ipt-ipopt - 5.4.164-1
kmod-ipt-iprange - 5.4.164-1
kmod-ipt-ipset - 5.4.164-1
kmod-ipt-nat - 5.4.164-1
kmod-ipt-nat6 - 5.4.164-1
kmod-ipt-nathelper-rtsp - 5.4.164+2.14-9
kmod-ipt-offload - 5.4.164-1
kmod-ipt-physdev - 5.4.164-1
kmod-ipt-raw - 5.4.164-1
kmod-ipt-sctp - 5.4.164-1
kmod-ipt-tproxy - 5.4.164-1
kmod-iptunnel - 5.4.164-1
kmod-leds-gpio - 5.4.164-1
kmod-lib-crc-ccitt - 5.4.164-1
kmod-lib-crc32c - 5.4.164-1
kmod-lib-textsearch - 5.4.164-1
kmod-macvlan - 5.4.164-1
kmod-netlink-diag - 5.4.164-1
kmod-nf-conntrack - 5.4.164-1
kmod-nf-conntrack-netlink - 5.4.164-1
kmod-nf-conntrack6 - 5.4.164-1
kmod-nf-flow - 5.4.164-1
kmod-nf-ipt - 5.4.164-1
kmod-nf-ipt6 - 5.4.164-1
kmod-nf-nat - 5.4.164-1
kmod-nf-nat6 - 5.4.164-1
kmod-nf-nathelper-extra - 5.4.164-1
kmod-nf-reject - 5.4.164-1
kmod-nf-reject6 - 5.4.164-1
kmod-nfnetlink - 5.4.164-1
kmod-nls-base - 5.4.164-1
kmod-ppp - 5.4.164-1
kmod-pppoe - 5.4.164-1
kmod-pppox - 5.4.164-1
kmod-qca-cnss - 5.4.164+g18d0d6a-dirty-1
kmod-qca-mcs - 5.4.164+g18d0d6a-dirty-1
kmod-qca-nss-dp - 5.4.164+g18d0d6a-dirty-1
kmod-qca-nss-drv - 5.4.164+g18d0d6a-dirty-2
kmod-qca-nss-drv-bridge-mgr - 5.4.164+g18d0d6a-dirty-2
kmod-qca-nss-drv-pppoe - 5.4.164+g18d0d6a-dirty-2
kmod-qca-nss-drv-vlan-mgr - 5.4.164+g18d0d6a-dirty-2
kmod-qca-nss-ecm-standard - 5.4.164+g18d0d6a-dirty-1
kmod-qca-nss-macsec - 5.4.164+g18d0d6a-dirty-1
kmod-qca-ssdk-nohnat - 5.4.164+g18d0d6a-dirty-1
kmod-qca-wifi-lowmem-profile - 5.4.164+g18d0d6a-dirty-1
kmod-slhc - 5.4.164-1
kmod-tun - 5.4.164-1
kmod-udptunnel4 - 5.4.164-1
kmod-udptunnel6 - 5.4.164-1
kmod-usb-core - 5.4.164-1
kmod-usb-dwc3-internal - 5.4.164+1-1
kmod-usb-dwc3-qcom-internal - 5.4.164+1-1
kmod-usb-gadget - 5.4.164-1
kmod-vxlan - 5.4.164-1