Adding OpenWrt support for Xiaomi AX3600

The latest commit IPQ807x-5.10-backports are poor wifi 5ghz performance with NAT. But iperf lan-lan performance normal.
My topology:
pc-server --->wired-link---->dhcp-wan-AX6router---->wifi-link---->pc-client-intel_ax201_card

iperf3 down-speed ~ 900Mbps, but up-speed only ~ 110Mbps on 5ghz radio.

I'm noticed some package changed: kmod-qca-nss-drv-bridge-mgr kmod-qca-nss-drv-pppoe kmod-qca-nss-drv-vlan-mgr

I'm installed all qca/nss packages related:

kmod-qca-nss-dp - 5.10.75+2021-03-26-e0c89348-1
kmod-qca-nss-drv - 5.10.75+2021-04-26-1cf4bf81-1
kmod-qca-nss-drv-bridge-mgr - 5.10.75+2021-04-29-b93c72c1-1
kmod-qca-nss-drv-pppoe - 5.10.75+2021-04-29-b93c72c1-1
kmod-qca-nss-drv-vlan-mgr - 5.10.75+2021-04-29-b93c72c1-1
kmod-qca-nss-ecm - 5.10.75+2021-04-29-c115aec3-1
nss-firmware-ipq8074 - 2021-09-13-b06171cb-1

It is very grueling to search in all 4321 post how this works with initramfs. Can anyone summarize this ?

Like any other device, you boot the initramfs image and it acts like a live system and then you can flash/recover, test or do whatever you want

How can i boot the initrams image on the router, if i don't have access per ssh oder luci und if the boot of the oem 1.0.17 with tftp does not work ?

You need UART as it require bootloader access

@dchard They are finally implementing WMI_REG_CHAN_LIST_CC_EXT_EVENTID for regulatory.

1 Like

You might not like what I say, but yes. If you cant use the search engine, then you need to read 4321 posts. This is a developer topic, we are not here to educate you about how to do basic things, like an initramfs boot.

@robimarko do we need to wait for a new firmware release for that to work, or it is enough to backport that code?

It should work as long as the patches are backported as already list that WMI code

Hm... I know how much you like backporting already :wink:

Yeah, because its a real pain, like doing things twice.
Its nice if you can just apply the patch, otherwise its just annoying.

Turns out, the fix wasn't complete. Now I have an ECM init failure in dmesg:

[   12.836446] ECM init
[   12.836523] ECM database jhash random seed: 0xeafdd7fc
[   12.839932] ecm_conntrack_notifier_init:430:Can't register nf notifier hook.
[   12.889818] ECM init failed: -16

as well as weird WAN download behavior (notice, how upload speed ramps up very quickly, while download speed increases slowly, this is accompanied by 100% cpu load on a single core):
and dropped packets on the bridge interface that acts as a switch.

Like I said previously, the chance of ECM and all of the QCA specific kmods working through time is close to zero.
Its a constant battle between kernel updates and FW

This is very familiar, I had the same issue some time ago, there are two drivers trying to register to the same notifier. So you probably have one driver that races with ecm(this was my case when selecting the mini-upnpd). Solution is to either use the patch that supports the chaining of notifiers or drop the second driver that uses it.

My side effect of this issue was packet corruption: in some cases it was impossible to setup TLS channels and git clone would always fail.

For what it's worth, my previos build of robi's branch with FW 11.4(with 512MB patches) is rock solid, I haven't touched the router in ages.


I am missing only the last patch of yours ( Add NSS bridge-mgr support ), and I see no issues at all. PPPoE offload is fully functional, although I am not using IPv6. Wired speeds are fine, both LAN-LAN and WAN-LAN with PPPoE offload engaged.

Just for reference, I'll leave here the memory graphs of my 2 AX3600:

"router-1" does most of the "heavy lifting". Has wireless and wired clients, dhcp server, VLANs, serves as "statistics" collector, and is the actual router of the network.
"router-2" functions as a switch and AP, nothing more (but still has wired and wireless clients).

Both of them are running the AX3600-5.10-restart branch + 512MB patch.


Yes, noticed the encrypted connection resets too. Doing rmmod nf_conntrack_netlink helped, but I would potentially like to have upnp working. Could you point me at the netfilter notifier chaining patch?

I compared OpenWRT's and stock's hostapd config for both bands and highlighted the differences.
I understand that VHT isn't supported on 2.4GHz on OpenWRT but do you or anybody know what the other discrepancies do? @robimarko

OpenWRT 2.4g:

Stock 2.4g:


OpenWRT 5g:


Stock 5g:


SMPS-DYNAMIC is a power save feature for 802.11n, the clients can turn off all radio chains but one to save power.

[SHORT-GI-20][SHORT-GI-40] should be present in the stock variant as well, probably the firmware is setting it anyway, as short-gi is the default working of the standard.

[SOUNDING-DIMENSION-4] is the sounding signal for beamforming, the number likely means the number of layers. This is optional but with the BF flags set, this should be set as well. Again, the firmware likely sets this internally. Checking these flags on the radio side (what the unit actually transmits into the air) would be interesting.

1 Like

The patch is over here: this enables the chained notifiers

1 Like

Awesome post!

Following the topic...
I plan to buy a Chinese version AX3600 soon on Alliexpress and bring it here to Brazil!

r3pek Would you mind sharing your firmware?