Adding OpenWrt support for Xiaomi "Redmi Router AX6S"/"Xiaomi Router AX3200"

Edit:

I think I found the scheme.

I just ordered a flasher.
Can you explain which pins we need to connect to the flashing device?

Can we use the unpopulated pins left next to the chip for the soldering?

https://www.gigadevice.com/datasheet/gd5f1gq5xexxg

I believe that you will have to also add that part to drivers/mtd/mtk-snand/mtk-snand-ids.c, as I do not believe that particular chip has support in the driver yet. Luckily you just add the chip id and characteristics, all of which you can find in the data sheet. You will also have to add support in snander.

I do however note that it's one of the parts listed by the u-boot dump that came on my unit, and there are a couple of other parts in there that don't have support either.

Did you use the unpopulated pins next to the spi-nand, to solder the connection cables for the programmer?

I've tried to lead out from the empty pad next to me, or directly at the chip contact, but the programmer can't recognize the chip. I searched and consulted relevant information on the Internet. It said there was interference on the PCB circuit board. It was necessary to disconnect the VCC at pin 8 to identify the chip. I didn't try. Of course, you can try it.

1 Like

4 Likes

Thanks a lot for the information! I guess we need to fix the disconnect afterwards to run the router or is not required?

Hi all,
First I'd like to say thank you for the great work, it is not trivial.
I've been waiting for a Xiaomi AX device that will support the amazing openWRT, checking the ToH on a daily basis.
I'd like to order one and be ready, as it will take a month to arrive.
Just to make sure I went over this thread correctly, we need the global version RB01 correct?

If someone is interested, this Aliexpress store contains both versions, and there is a nice sale in an hour

New Xiaomi Router AX6S/AX3200 Wifi 6 Dual Band 3202Mbs Gigabit Rate Security Encryption Mesh Wifi External Signal Amplifier|Wireless Routers| - AliExpress

(Another 5$ coupon for 3 days: AA405)

1 Like

Everyone can help me? My device U-boot can't load initramfs. I try to load initramfs with tftpboot ax6s.itb, however,after initramfs loaded, it doesn't enter the kernel, it returns to u-boot main menu.

MT7622> tftpboot ax6s.itb
Using mtk_eth device
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'ax6s.itb'.
Load address: 0x4007ff28
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ########################################################
         7.4 MiB/s
done
Bytes transferred = 15124288 (e6c740 hex)
get filesize 0xe6c740
Automatic boot of image at addr 0x4007FF28 ...
bootm flag=0, states=70f
## Loading kernel from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-5.10.85
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x40080010
     Data Size:    3789879 Bytes = 3.6 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x44000000
     Entry Point:  0x44000000
     Hash algo:    crc32
     Hash value:   ccf09c76
     Hash algo:    sha1
     Hash value:   3694aca975e76179b0ebf1602c496bf9da61b070
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'initrd-1' ramdisk subimage
     Description:  ARM64 OpenWrt xiaomi_redmi-router-ax6s initrd
     Type:         RAMDisk Image
     Compression:  Unknown Compression
     Data Start:   0x4041d58c
     Data Size:    11304280 Bytes = 10.8 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: unavailable
     Entry Point:  unavailable
     Hash algo:    crc32
     Hash value:   289f808a
     Hash algo:    sha1
     Hash value:   c9a8ed06249f1b856b261082915208cf4355b30c
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 4007ff28 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt xiaomi_redmi-router-ax6s device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x40ee53f8
     Data Size:    27950 Bytes = 27.3 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   7bf7fc16
     Hash algo:    sha1
     Hash value:   d2e882d861d93763a2c59d5e8af3bedc64cec952
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x40ee53f8
   Uncompressing Kernel Image ... OK
   Loading Ramdisk to 4c47b000, end 4cf42d58 ... OK
   Loading Device Tree to 4c471000, end 4c47ad2d ... OK

Starting kernel ...

[ATF][   203.323336]save kernel info
[ATF][   203.326273]Kernel_EL2
[ATF][   203.328943]Kernel is 64Bit
[ATF][   203.332031]pc=0x44000000, r0=0x4c471000, r1=0x0
INFO:    BL3-1: Preparing for EL3 exit to normal world, Kernel
INFO:    BL3-1: Next image address = 0x44000000
INFO:    BL3-1: Next image spsr = 0x3c9
[ATF][   203.349729]el3_exit
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.10.85 (runner@fv-az132-969) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 8.4.0 r3984-0cadba2d4) 8.4.0, GNU ld (GNU Binutils) 2.34) #0 SMP Thu Dec 16 04:55:51 2021
[    0.000000] Machine model: Xiaomi Redmi Router AX6S
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x000000004fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000] On node 0 totalpages: 65536
[    0.000000]   DMA zone: 1024 pages used for memmap
[    0.000000]   DMA zone: 0 pages reserved
[    0.000000]   DMA zone: 65536 pages, LIFO batch:15
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv0.2 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: Trusted OS migration not required
[    0.000000] percpu: Embedded 20 pages/cpu s43800 r8192 d29928 u81920
[    0.000000] pcpu-alloc: s43800 r8192 d29928 u81920 alloc=20*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: ARM erratum 845719
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] CPU features: detected: ARM erratum 843419
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64512
[    0.000000] Kernel command line: console=ttyS0,115200n1 loglevel=8 swiotlb=512 rootfstype=squashfs firmware=0 uart_en=1 factory_mode=1
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 221456K/262144K available (7870K kernel code, 856K rwdata, 2184K rodata, 448K init, 289K bss, 40688K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     CONFIG_RCU_FANOUT set to non-default value of 32.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GIC: GICv2 detected, but range too small and irqchip.gicv2_force_probe not set
[    0.000000] random: get_random_bytes called from start_kernel+0x340/0x48c with crng_init=0
[    0.000000] arch_timer: cp15 timer(s) running at 12.50MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2e2049cda, max_idle_ns: 440795202628 ns
[    0.000003] sched_clock: 56 bits at 12MHz, resolution 80ns, wraps every 4398046511080ns
[    0.000175] Calibrating delay loop (skipped), value calculated using timer frequency.. 25.00 BogoMIPS (lpj=125000)
[    0.000185] pid_max: default: 32768 minimum: 301
[    0.000257] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.000264] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.001222] rcu: Hierarchical SRCU implementation.
[    0.001316] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.001507] smp: Bringing up secondary CPUs ...
[    0.001820] Detected VIPT I-cache on CPU1
[    0.001862] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.001925] smp: Brought up 1 node, 2 CPUs
[    0.001933] SMP: Total of 2 processors activated.
[    0.001938] CPU features: detected: 32-bit EL0 Support
[    0.001942] CPU features: detected: CRC32 instructions
[    0.002046] CPU: All CPU(s) started at EL2
[    0.002057] alternatives: patching kernel code
[    0.005306] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.005325] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.005412] pinctrl core: initialized pinctrl subsystem
[    0.005842] NET: Registered protocol family 16
[    0.006452] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.006478] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.006503] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.006830] thermal_sys: Registered thermal governor 'fair_share'
[    0.006835] thermal_sys: Registered thermal governor 'bang_bang'
[    0.006840] thermal_sys: Registered thermal governor 'step_wise'
[    0.006845] thermal_sys: Registered thermal governor 'user_space'
[    0.007120] ASID allocator initialised with 65536 entries
[    0.007732] pstore: Registered ramoops as persistent store backend
[    0.007741] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.034978] SCSI subsystem initialized
[    0.035094] libata version 3.00 loaded.
[    0.035261] usbcore: registered new interface driver usbfs
[    0.035292] usbcore: registered new interface driver hub
[    0.035318] usbcore: registered new device driver usb
[    0.036519] clocksource: Switched to clocksource arch_sys_counter
[    0.037110] NET: Registered protocol family 2
[    0.037199] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.037484] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.037498] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.037517] TCP bind hash table entries: 2048 (order: 3, 32768 bytes, linear)
[    0.037551] TCP: Hash tables configured (established 2048 bind 2048)
[    0.037630] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.037647] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.037743] NET: Registered protocol family 1
[    0.037763] PCI: CLS 0 bytes, default 64
[    0.037866] Unpacking initramfs...
[    2.867475] Freeing initrd memory: 11036K
[    2.868406] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    2.871036] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.871045] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.906893] mt-pmic-pwrap 10001000.pwrap: unexpected interrupt int=0x1
[    2.921058] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
[    2.921621] printk: console [ttyS0] disabled
[    2.921676] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 21, base_baud = 1562500) is a 16550A
[    3.526490] printk: console [ttyS0] enabled
[    3.531930] mtk_rng 1020f000.rng: registered RNG driver
[    3.536668] random: fast init done
[    3.537450] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    3.540687] random: crng init done
[    3.549454] loop: module loaded
[    3.553907] mtk-snand 1100d000.snfi: chip is F50L1G41LB, size 128MB, page size 2048, oob size 64
[    3.564698] [BBT] BMT.v2 is found at 0x3ff
[    3.576137] 11 fixed-partitions partitions found on MTD device 1100d000.snfi
[    3.583226] Creating 11 MTD partitions on "1100d000.snfi":
[    3.588712] 0x000000000000-0x000000080000 : "Preloader"
[    3.595169] 0x000000080000-0x0000000c0000 : "ATF"
[    3.600561] 0x0000000c0000-0x000000140000 : "u-boot"
[    3.606618] 0x000000140000-0x000000180000 : "u-boot-env"
[    3.612585] 0x000000180000-0x0000001c0000 : "bdata"
[    3.618144] 0x0000001c0000-0x000000240000 : "factory"
[    3.624264] 0x000000240000-0x000000280000 : "crash"
[    3.629865] 0x000000280000-0x0000002c0000 : "crash_log"
[    3.635728] 0x0000002c0000-0x0000020c0000 : "firmware"
[    3.692489] 2 fit-fw partitions found on MTD device firmware
[    3.698150] Creating 2 MTD partitions on "firmware":
[    3.703109] 0x000000000000-0x0000003a0000 : "kernel"
[    3.714452] 0x0000003a0000-0x000001e00000 : "rootfs"
[    3.764399] mtd: device 10 (rootfs) set to be root filesystem
[    3.770373] mtdsplit: no squashfs found in "rootfs"
[    3.775250] 0x0000020c0000-0x000003ec0000 : "firmware1"
[    3.831646] 0x000003ec0000-0x000008000000 : "ubi"
[    3.836343] mtd: partition "ubi" extends beyond the end of device "1100d000.snfi" -- size truncated to 0x3700000
[    3.952282] mtk-snand 1100d000.snfi: ECC: Uncorrectable bitflips in page 1152 sect 0
[    3.960056] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[    3.968836] Mem abort info:
[    3.971620]   ESR = 0x96000005
[    3.974666]   EC = 0x25: DABT (current EL), IL = 32 bits
[    3.979972]   SET = 0, FnV = 0
[    3.983016]   EA = 0, S1PTW = 0
[    3.986146] Data abort info:
[    3.989021]   ISV = 0, ISS = 0x00000005
[    3.992847]   CM = 0, WnR = 0
[    3.995806] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000040b85000
[    4.002242] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[    4.010946] Internal error: Oops: 96000005 [#1] SMP
[    4.015813] Modules linked in:
[    4.018862] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.10.85 #0
[    4.024857] Hardware name: Xiaomi Redmi Router AX6S (DT)
[    4.030162] pstate: 20000005 (nzCv daif -PAN -UAO -TCO BTYPE=--)
[    4.036164] pc : upload_bmt+0x144/0x1b0
[    4.039990] lr : update_bmt+0x94/0xc0
[    4.043641] sp : ffffffc010b9b0f0
[    4.046946] x29: ffffffc010b9b0f0 x28: ffffffc010afd090
[    4.052251] x27: 0000000000000200 x26: 00000000ffffffb6
[    4.057555] x25: ffffffc01095d688 x24: ffffffc01095d680
[    4.062860] x23: 00000000000003ff x22: 000000000000004f
[    4.068164] x21: 000000000000013c x20: ffffff8006030000
[    4.073469] x19: ffffffc010b63db8 x18: 0000000000000000
[    4.078773] x17: 0000000000000000 x16: 0000000000000000
[    4.084078] x15: ffffffffffffffff x14: ffffffffffffffff
[    4.089383] x13: ffffffffffffffff x12: ffffffffffffffff
[    4.094688] x11: ffffffffffffffff x10: ffffffffffffffff
[    4.099992] x9 : ffffffffffffffff x8 : ffffffffffffffff
[    4.105297] x7 : 0000000000000000 x6 : 0000000000020000
[    4.110601] x5 : 0000000000000000 x4 : 0000000000000000
[    4.115905] x3 : 0000000000000000 x2 : 0000000000000000
[    4.121210] x1 : ffffffc010b9b140 x0 : ffffff8000d878e0
[    4.126515] Call trace:
[    4.128954]  upload_bmt+0x144/0x1b0
[    4.132432]  update_bmt+0x94/0xc0
[    4.135739]  mtk_bmt_read+0x174/0x1a8
[    4.139395]  mtd_read_oob_std+0x5c/0x88
[    4.143223]  mtd_read_oob+0x80/0x140
[    4.146790]  mtd_read+0x30/0x48
[    4.149924]  mtdblock_readsect+0x48/0x160
[    4.153924]  mtd_queue_rq+0x31c/0x4e0
[    4.157582]  __blk_mq_try_issue_directly+0x10c/0x1a8
[    4.162538]  blk_mq_try_issue_directly+0x40/0xd8
[    4.167147]  blk_mq_submit_bio+0x370/0x380
[    4.171234]  submit_bio_noacct+0x348/0x3c8
[    4.175320]  submit_bio+0x44/0x168
[    4.178718]  submit_bh_wbc+0x184/0x1d0
[    4.182458]  block_read_full_page+0x2d8/0x3b0
[    4.186805]  blkdev_readpage+0x18/0x20
[    4.190547]  do_read_cache_page+0x574/0x710
[    4.194722]  read_cache_page+0x10/0x18
[    4.198469]  read_part_sector+0x40/0x100
[    4.202384]  read_lba+0xc0/0x170
[    4.205603]  efi_partition+0xd8/0x530
[    4.209258]  blk_add_partitions+0x124/0x520
[    4.213433]  bdev_disk_changed+0x9c/0x128
[    4.217433]  __blkdev_get+0x530/0x678
[    4.221086]  blkdev_get+0x4c/0xd0
[    4.224392]  blkdev_get_by_dev+0x34/0x58
[    4.228307]  __device_add_disk+0x1ac/0x438
[    4.232394]  device_add_disk+0x10/0x18
[    4.236135]  register_mtd_blktrans_devs+0x68/0xf0
[    4.240830]  mtd_device_parse_register+0xb4/0x1a8
[    4.245528]  mtk_snand_probe+0x438/0x578
[    4.249447]  platform_drv_probe+0x50/0xa0
[    4.253448]  really_probe+0xec/0x3a0
[    4.257015]  driver_probe_device+0x54/0xb0
[    4.261103]  device_driver_attach+0x6c/0x78
[    4.265277]  __driver_attach+0x54/0xd0
[    4.269017]  bus_for_each_dev+0x60/0x98
[    4.272844]  driver_attach+0x20/0x28
[    4.276410]  bus_add_driver+0x178/0x1d8
[    4.280238]  driver_register+0x60/0x110
[    4.284066]  __platform_driver_register+0x44/0x50
[    4.288763]  mtk_snand_driver_init+0x18/0x20
[    4.293025]  do_one_initcall+0x74/0x1c0
[    4.296853]  kernel_init_freeable+0x240/0x2ac
[    4.301202]  kernel_init+0x10/0x10c
[    4.304682]  ret_from_fork+0x10/0x18
[    4.308253] Code: b944cc42 9ac20883 9b029062 290a0be3 (f94000e2)
[    4.314340] ---[ end trace f0d51eafbb200e17 ]---
[    4.320184] Kernel panic - not syncing: Oops: Fatal exception
[    4.325922] SMP: stopping secondary CPUs
[    4.329838] Kernel Offset: disabled
[    4.333317] CPU features: 0x0000002,04002004
[    4.337576] Memory Limit: none
[    4.341877] Rebooting in 1 seconds..

F0: 102B 0000
F6: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 0000 0041 [0000]
G0: 0190 0000
T0: 0000 036E [000F]
Jump to BL

It's not really my problem if someone's strange OpenWrt fork based on still in-progress porting didn't boot. Tell them not to ignore the label on the commit title that says "WIP" before removing it and churning out images with it... :rofl:

1 Like

Thank you for your great jobs! It let ax6s openwrt working.. This is not your problem. I tyr to run openwrt on my own device, but I have tried several compiled initramfs. but can't load.

Should I buy ax3200 global?
Or Chinese ax6s...

Screenshot_20220103-200510

@namidairo @slh @remittor

I found something really interesting.

On RB03 (firmware: v1.0.37), /cgi-bin/luci/;stok=<stok>/api/xqnetwork/check_wan_link returns:

Available commands:
	start	Start the service
	stop	Stop the service
	restart	Restart the service
	reload	Reload configuration files (or restart if service does not implement reload)
	enable	Enable service autostart
	disable	Disable service autostart

Status: 200 OK
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache
Expires: 0
Content-Length: 12

{"code":"0"}

Response headers:

HTTP/1.1 200 OK
Server: nginx/1.12.2
Date: Sat, 08 Jan 2022 21:51:54 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Syntax: /etc/init.d/network [command]
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache

IDK if it can be used as an exploit entrance.

1 Like

Oh yeah, since that is run directly in the shell.
If you can send any arguments than it should work

I think sending args is difficult. I decompiled xqnetwork.lua and found that this method itself seems not to accept any args. It may be an outdated method, executing /etc/init.d/network reload_warm 2 eth0; sleep 1, but only to get a help message because reload_warm is no longer a valid command. But that's not the whole story. What really attracted my attention was that not only the help message could be inserted into the response but the response headers and body also got messed in such a situation. That‘s so weird. Currently I have no further idea about that.

Is there a hardware modification-less installation method for this yet, perfectly happy to build and write images using MTD, but don't have the skills to solder parts and hardware mod.

I suspect that it was you who reported this bug to the manufacturer.
On December 30, 2021, Xiaomi released a new firmware for RB01, in which the this bug was fixed.

Tell us already how to use your founded vulnerability.
Comparing the files in the firmware, I could not understand what they fixed critical.

1 Like

Nope. I didn't look hard enough at it to have enough details to report it, nor would it feel right to do so for something already in the wild. Presumably they noticed the payloads floating around for the other models.

I do know that they read the various Chinese enthusiast forums every once in a while. Perhaps here as well.

I checked that new image... What I found does not appear to be fixed. (It has build date in November) In addition, they've stopped replying to me...

/shrug

When was the first time you contacted them?
I believe there is a 90-days grace period and then you can publish it
If they have not contacted you and asked for more time.