Adding OpenWrt support for Xiaomi AX3600 (Part 1)

...which is presumably IPQ8071. More information expected during during Mi 10 launch on Feb 13th.

I hope we will get relatively affordable high-end device which has good chances of being supported by OpenWRT.


Do you want to actively help in getting this (not even available) device supported?

If yes, can you please change the topic title to "Adding OpenWrt support for AX3600"?

1 Like

I guess Xiaomi would not allow SSH access for this router too. So without open the case it's impossible to flash a third-party firmware.

Some more info: price is 599 CNY (~$86) in China.

SOC: Qualcomm IPQ8071A (Quad core A53 @ 1 Ghz + 2x 1.7 Ghz network acceleration cores)
RAM: 512 MB
ROM: 256 MB
Antennas: 2x 2.4GHz + 4x 5GHz + 1x "IoT antenna"
PSU: 12V 2A

1 Like

Are there any sources for this SoC on codeaurora?

1 Like

Previous Xiaomi routers have had serial interfaces on their motherboards that can allow access to the console with a little bit of soldering knowhow and a USB-TTL module. The only model I've seen that has this feature is the Xiaomi Mi Router 3.

This video shows the process of how to do it, and if you look closely at 14:51, you can see that the router is actually running OpenWrt out of the box!

Granted, this model is an older one, and it runs a MIPS CPU from Mediatek instead of the ARM one from Qualcomm that the AIoT router uses, but maybe the AIoT router runs OpenWrt as well. If it has a serial interface, someone could probably get into the console and flash a custom firmware. Knowing Xiaomi, they tend to update their custom software but not the underlying codebase (like how Xiaomi updates MIUI often but doesn't do the same with Android), so there's a chance that their newer routers are still running OpenWrt like their older ones.,

But by default Xiaomi locks serial console input. You must set uart_en uboot env var to 1 to enable it.

It's going to be a long while before anybody gets this in their hands.

I doubt that this will be the same mechanism on this device.
All device that are locked this way has a mediatek soc and uses the highly modified and outdated ralink u-boot.

As the new device comes with a qualcomm chipset, they can use a lot more features to secure the device boot process.
The worst case could be a trusted boot chain with permanent secure boot.


Hey, I live in China and I'm planning to buy this router. Any updates on the possibility to install OpenWRT on it? Is opening the case and soldering really required, or is there some other way to get the firmware on it?

AFAIK there is currently no way at all to install openwrt. Nobody has done it yet

How much is the router if you buy it in China? I know the official price is like 89 usd but is it really available at that price?

599CNY,about 84.711 usd

And that is the price it can be bought for in China? I'm asking because on AliExpress the device costs at least 120 usd which is a hefty extra charge of 35 usd or more than a third of the device's price. That's quite a lot imo.

I just spotted it for around 110$ without discounts or coupons applied. Not too bad considering some dude needs to buy, package and ship it to you and prob wants to make a few dollars as well for doing so.

Strongly considering this device as I need WiFi 6 router.

The Huawei is a lot cheaper though but seems less spec.

Yep I bought it for the official price of 599 RMB which is 85 USD or 78 EUR.

So my current plan is to use this router for WiFi network, and since OpenWRT is not supported at this time, I got an additional OrangePi R2S with dual gigabit Ethernet to plug in between the modem and the WiFi router. The OrangePi supports OpenWRT so I hope to be able to do all the configuration that I want.

This is neither the most energy efficient solution nor the one with least cabling, and might also not be the cheapest, but I hope to get maximum flexibility for a reasonable price (around 100$).

I bought it at this price. But you must make a panic purchase, or you must pay more at 3rd store

it looks like this exploit might work for this router

1 Like

seems not working New Xiaomi Router AC2100

this router is ARM based and the script was written for mips, pppd is likely to be exploitable in this router too but the script might need to be modified