Adding OpenWrt support for Xiaomi "Redmi Router AX6S"/"Xiaomi Router AX3200"

For Developers
1690

If the 2022 bootloader is installed, then after 5...12 reboots the bootloader will try to boot only from partition 1 if flag_last_success = 0:

      if ( _try_sys )
        boot_part_num = 1 - flag_last_success;

That is, in this case, the bootloader will wait endlessly for a button press in the UART console.

The real situation that happened yesterday to the owner of the AX6S router 
flag_boot_rootfs=1
flag_boot_success=1
flag_boot_type=2
flag_last_success=0
flag_ota_reboot=0
flag_try_sys1_failed=6
flag_try_sys2_failed=86
2 Likes
1691

Hi, I can confirm, that I'm having the very same issue with ax3200 too. After a few reboots my ax3200 self bricks and I have to recover firmware using dnsmasq to official and then using xmir patcher to openwrt again. Happened 2 times already, so it does not look like coinscidence. I have not tried breed bootloader yet, will that help? Thank you.

1692

Don't change the bootloader.
Better just run these commands:

fw_setenv boot_fw1 "run boot_rd_img;bootm"
fw_setenv flag_try_sys1_failed 8
fw_setenv flag_try_sys2_failed 8
fw_setenv flag_boot_rootfs 0
fw_setenv flag_boot_success 1
fw_setenv flag_last_success 1
1 Like
1693

In order to provide clear instructions in the Wiki, is there anyway to identify bootloader version from the telnet session without having to connect the UART console to check the bootloop?

I mean, I just trying to write a text such as "use these commands if the bootloader of your device is 2021 or these other commands if the bootloader version is 2022. In order to check the bootloader version do ???".

Or do the commands below work for both bootloader versions?

fw_setenv boot_fw1 "run boot_rd_img;bootm"
fw_setenv flag_try_sys1_failed 8
fw_setenv flag_try_sys2_failed 8
fw_setenv flag_boot_rootfs 0
fw_setenv flag_boot_success 1
fw_setenv flag_last_success 1
1695

I suspect you'd have to compute a hash over parts or the entire bootloader. Either pipe a read to md5sum or copy the bootloader to /tmp.

Although I believe u-boot is buildable for this platform, nobody has tested because you'd need equipment to recover if you didn't get it right. (A programmer + clip, and maybe even a rework station)

1 Like
1696

Hi all,

I've had a Xiaomi AX6S (RB03) sitting in storage for quite a while now, so I figured I'd finally get the firmware flashed with OpenWRT. Following the installation steps within the documentation produced a successful outcome. I genuinely appreciate the effort involved with developing and documenting the procedure.

However, after executing mtd -r write factory.bin firmware, it rebooted to MiWiFi (as opposed to OpenWRT). Based on reading the entirety of this topic, this seems to be a common occurrence resolved by executing nvram set flag_ota_reboot=1; nvram commit; reboot. My confusion stems from the recommendation within the documentation to "go back to step 8 and flash again". Presumably this isn't possible, as the write operation to the firmware (i.e., OpenWRT) partition was likely successful, but the boot target remains set to the firmware1 (i.e., MiWiFi) partition, which is then corrected by executing nvram set flag_ota_reboot=1. During the initial boot for OpenWRT, seemingly the partition table is rewritten and the firmware1 (i.e., MiWiFi) partition ceases to exist.

So, I guess the above is a long-winded way of asking if I'm misunderstanding how this is functioning under the hood or if the documentation needs to be updated?

1697

Check value of params: flag_try_sys1_failed and flag_try_sys2_failed.
If one of these parameters exceeds 5, then you have a fresh bootloader.

Now the documentation says bullshit.
If you set the required values for the nvram parameters, the bootloader will not try to use the second partition during the first reboot.
It also surprises me that the documentation forgot about the flag_last_success parameter.

And it is better to always set the flag_ota_reboot parameter to 0, since different bootloaders react to this params differently!

1698

Type any command on stock firmware:

dd if=/dev/mtd2 2>/dev/null | grep -cF " 2022 - "
dd if=/dev/mtd2 2>/dev/null | grep -cF "do_env_export"
dd if=/dev/mtd2 2>/dev/null | grep -cF "GigaDevice"

result 0: older bootloader
result 1: freshed bootloader

2 Likes
1699

My router got bricked yesterday after a power failure. Also, I noticed it bricked every time I used the "Perform reset" (reset to defaults) option in OpenWrt.

I just de-bricked it and re-installed OpenWrt, used these new NVRAM options, and performed a reset-to-defaults to test if it would brick again; it didn't. Thank you.

Also, note that I tried this method to check if I have the new bootloader, and all 3 statements returned "0", indicating I have the old bootloader. Still, the new NVRAM options seemed to fix my issues.

I'll let you know if it gets bricked again.

2 Likes
1700

Perfect, thank you! Tried a several reboots, also hard unplug and router still boots to openwrt now. I nearly started to have tin foil hat suspicion the Chinese remotely brick routers with unoriginal fw :slight_smile: because it always happened after connecting to internet and I have been only aware sysupgrade leads to brick :flushed: Someone with enough reputation should update wiki.

Btw. why not use the breed boot loader? It should have telnet console. I know changing boot loader is dangerous, because it can lead to complete brick if it fails, but how likely is that? And other than that? I don't know what can boot loader do, but I'd prefer to have everything opensource without any chinese software.

And thanks to all developers, you are awesome.

1701

I got 0,1,1 how should I interpret this?
The devices are brand new, came with older stock firmware with telnet enabled. Running as dumb AP on OpenWrt 23.05.2 , all is working smoothly.

1702

Router AX3200. On the 5th reboot it stops loading. All 3 commands return - 0. Recovery through the Xiaomi tool. Used recommended commands. After that I flash the firmware via xmir-patcher and so far everything works. Among several hundred routers that were flashed, this is the first one that died in my hands.

1 Like
1703

Is there a 100% way to check the bootloader version?
Or do you now need to reboot the router 5-12 times after updating the firmware, and if it still loads, assume that the bootloader is old?
In my case, all 3 proposed commands produced a result of 0, which, as it turned out, was not correct.

1 Like
1704

Hello everyone, does anyone have a backup of the old u-boot 2021 (BL2 + FIP) for my shipment, thank you. to all. Sorry to m'y english

1 Like
1705
2 Likes
1706

thank you very much but I don't know how to extract it in mtd fip.bin format, possible to send them to me in this format thank you again and I thank you for your hard work for the community

1707

@ Lexeyko

On the 5th reboot it stops loading... After that I flash the firmware via xmir-patcher and so far everything works.

I have an AX6S RB03 version. I tried flashing via official instruction using so called "closed beta" fw, but even then device showed that telnet was inactive. So I had to use XMiR-Patcher. Everything worked OK during ~5 days, then after power on the System led remained orange and router did not work. @Lexeyko, so be ready to debrick it again.

@All. If I understand correctly, official instructions are for linux. Could somebody provide detailed flashing/debricking instructions for Windows? I tried to "debrick" using official instruction (TFTP method) but failed do it on Windows. I used tftpd64 but probably set up something wrong: I didn't see any activity.

1708

have you tried to debrick with the xiaomi miwifi repair tool software

1709

Yes, it was the only working method for me.

1710

We have the same issue in our device
Hardware: AX3200 RB01.
Firmware: Openwrt 23.05.2.

After upgrading the frimware from Xiaomi default to OpenWRT 23.05.2 we reboot the Router couple of times then its stop loading and got bricked. Its happend twice with us we de-bricked the device with TFTPD and install OpenWRT fw, again after few restart its bricked and stop loading.