Hi, from which seller did you buy from? I also selected the AX6S RB03 and chose EU adapter but I don't want them to send the AX3200 RB01 incase it's locked...
As far as reported in this topic this is not possible.
Notice I've selected not an EU adapter but instead the EU original plug. The ad was saying AX6S/AX3200 but when I selected the "Original EU plug" the model changed to AX3200 and I did not notice. Luckily the AX3200 unit I've received had telnet open from factory. I`ve already ordered two other AX6S (from another seller) and I am waiting to be delivered (I plan to replace my 4 Archer C6 v3.2 with the AX6S due to 802.11ax support and better SoC).
1 Like
As I have written some posts before.
- Setup a TFTP Server for recovery, using one of the RB01 images, e.g. 1.0.71_INT.
- Connect to UART, 115200 Baud
- Start recovery/debrick procedure
- As soon as erasing starts, unplug the power cable
- Plug in power cable again, you should end up on a UBoot terminal
- Enable UART, Telnet, SSH, just to be sure. setenv uart_en=1; setenv telnet_en=1; setenv ssh_en=1
- Place image on TFTP server (Not sure, but I think I used openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-initramfs-recovery.itb)
- tftpboot openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-initramfs-recovery.itb
- This should end up in a booted openwrt
- Install to flash using sysupgrade
As far as I remember that's all I did to get it running on a locked RB01 from 11/21. Try it on your own risk!
5 Likes
ok thanks, I bought from another seller and when checking the reviews from other users I see everyone got the AX6S even though they chose EU adapter.
btw, which builds do you recommend, does everything work and is the WiFi coverage good enough? thanks
For starters I would recommend the 22.03 snapshot builds. While being snapshot builds at this point in time these builds are quite stable and already include LuCI.
1 Like
Thank you. If other users can reproduce these steps reliably we can consider adding these instructions to the wiki page.
Is there any bug report for the issue that limits the Ethernet speed to the lowest connected speed?
I faced this issue today and I do not use VLANs. I had one 100Mbps device connected to the AX6S switch and all ports were limited to 100Mbps.I unplugged this device, rebooted the router and then the switch speed was back to 1Gbps as expected.
I'm running the latest 22.03 snapshot build.
This is a serious problem, I thought it was fixed.
I have already ordered an AX6S router, it will be arriving in a week's time. 
I hope to get meshing working but it seems like the slow ethernet issue is a real worry.
All ports are capped at 100Mbps. 
Not really. The ports are capped at 100Mbps only if you connect a 100Mbps device. If all devices you connect to the Ethernet ports are Gigabit, all ports will work at full speed.
I could have sworn it was reverted last week. I don't have any 100FE stuff connected to mine, so I wouldn't really see it anyway.
Yes, it was reported:
And it was fixed for master as @namidairo wrote: https://github.com/openwrt/openwrt/commit/3e0daca6447c3d5b9eb6d24ecb8e52f256f385cc
1 Like
This was reported for the mt7530 switch driver tho. Should only affect the AX6S as AX3600 uses QCA switch? Btw, when I studied the mt7530 driver I find that the VLANs configuration code is not ideal, but it shouldn't cause thruput throttling. The one that I found causes issue for the mt7530 switch is the disabling of the source address learning capability of the switch. When I disabled the 'disabling of SA learning' the mt7530 router (in my case the Linksys E8450) goes back to full speed even when 10/100mbps clients connected. The entire patch that was reverted to 'fix' the issue can be retained.
Edit: I mistakenly thought that this is also a thread for the Xiami AX3600, but it was for the AX3200, which is mt7622 based, using the mt7531 switch. In any case, the above point still stands tho.
Interestingly in the R7800 thread it was also reported that if there's a 100mbps client connected to it and there's active data transfer between that client and other LAN clients, WAN thruput will be affected. I did a quick test with my R7800 and I also see the behaviour as reported. It doesn't look like it could be caused by the switch driver, but I do not have enough knowledge to determine the cause. My suspicion lies in the way data frames are passed between the GMAC and the CPU. Likely the same issue is affecting the AX6S and AX3600 and likely all routers?
2 Likes
I sent a mail to a shop who sells the AX3200 International version and asked about the date on the package and he answered 09/2021, is it guaranteed that they come with Telnet enabled with that date? if so I should have waited before buying the AX6S from Aliexpress as the shop with the AX3200 is the same country I live in...lol.
I am trying to reproduce johnd2's method.
During booting of the router I see regular U-Boot and kernel messages on my UART console.
But I can't type anything or get the boot process to halt, so it is not clear to me what the step "Start recovery/debrick procedure" means.
I have a BR01 (international) model from 11/2021 with fw 1.0.35 and according to routers fac_info page uart, telnet and ssh are disabled.
I just took a chance and bought two AX3200 International version with 09/2021 date, hopefully they have Telnet enabled. 
By "Start recovery/debrick procedure", he might mean the procedure for unbricking, not via console, but pressing the reset button and plugging the power in (you hold the reset botton in power off). Then halt the process by unplugging. Then follow the rest of guide.
I successful managed to flash my AX3200 BR01 (international model) using UART and a BOOTP/TFTP server. Here is an explanation of what I did:
I discovered (by watching the UART console) that if you hold the reset button on start, the U-Boot with halt and check again in 5 seconds if the button is still pressed. If this is true it starts looking for a BOOTP server to obtain an IP address and a TFTP location for an image. So I set up a server and served the image xiaomi_redmi-router-ax6s-initramfs-recovery.itb, which was rejected by U-Boot. There is probably a RSA public key on one of the later partitions that gets sometimes updated with the official firmware updates, which is used by U-Boot even in this recovery mode. Next I served the official 1.0.71 BR01 firmware image http://cdn.awsde0-fusion.fds.api.mi-img.com/xiaoqiang/rom/rb01/miwifi_rb01_firmware_bbc77_1.0.71_INT.bin that was found by @remittor. U-Boot started the flashing process by erasing and rewriting two partitions. So I was not sure, if a bootloader update was performed. I repeated this procedure and this time only one partition was erased and rewritten. Feeling more confident now, I repeated the process again this time unplugging the power during the erase process. After booting the router normally (without reset button pressed) U-Boot failed to boot (as intended) and offered me a prompt starting with "MT7622>". So I changed my BOOTP/TFTP server to serve the xiaomi_redmi-router-ax6s-initramfs-recovery.itb image and executed MT7622> tftpboot on the UART console. U-Boot obtained the necessary information via the BOOTP protocol and booted directly into OpenWRT . From this I assume that either some kind of RSA public key was erased by the previous procedure, or the U-Boot prompt after a failed boot attempt (indicating a bricked device) never performs signature checks on images.
7 Likes
Based on my previous longer post here is a short step-by-step flashing instruction for those who want to try flashing a BR01 model.
- Setup a UART console with RX and TX working (115200 Baud 8N1)
- Setup a BOOTP and TFTP server
2.1 I used bootp tftpd-hpa under Debian
2.2 Use the official 1.0.71 BR01 firmware image
2.3 The client mac address is set in step 4 - Start the router while pressing the RESET button for at least 5 seconds
- When the console shows that BOOTP broadcasts are sent, discover the MAC of the router in recovery mode using a tool like wireshark (this MAC is different to the one on the bottom of the device)
- Ensure by looking at the output on the UART console, that the the flashing process only touches one partition, otherwise if you cut the power while the bootloader is updated you need a NAND programmer (and an image of the right U-Boot image
)
5.1 If two partitions were flashed in the first run the second run should result in only one partition being flashed (my router from 11/2021 went from FW 1.0.35 --> 1.0.71) - Cut the power right after the erasing messages appear on the serial console
- Change the BOOTP/TFTP server to serve the
xiaomi_redmi-router-ax6s-initramfs-recovery.itbimage
7.1 I used the one from 22.03-SNAPSHOTS - Boot up the router without pressing the reset button and you should end up with a console like this
MT7622>where you can enterMT7622>tftpboot - Once you are in OpenWRT use scp to copy over the image
xiaomi_redmi-router-ax6s-squashfs-sysupgrade.binand executesysupgrade image.bin - The router should automatically reboot into a persistent OpenWRT .
Remarks:
- The BOOTP server can potentially be committed if using the official recovery tool from Xiaomi in step 2 and specifying the TFTP IP and location in step 8 explicitly.
- Most important is step 5 where you check that only the firmware (kernel+ramfs+rootfs) partition and not the bootloader partition is touched during the recovery flashing
11 Likes