Adding OpenWrt support for Xiaomi "Redmi Router AX6S"/"Xiaomi Router AX3200"

114514 · April 2, 2024, 5:01am

Hi, I have the same issue, radio1 disappeared and I have tried this guide and not working, any idea? thank you.

root@AX6S:~# dmesg | tail
[   13.514025] br-lan: port 2(lan2) entered forwarding state
[   17.066218] mt7530-mdio mdio-bus:00 lan1: Link is Up - 1Gbps/Full - flow control rx/tx
[   17.074251] br-lan: port 1(lan1) entered blocking state
[   17.079499] br-lan: port 1(lan1) entered forwarding state
[   18.781409] pppoe-wan: renamed from ppp0
[   19.749528] IPv6: ADDRCONF(NETDEV_CHANGE): wl0-ap0: link becomes ready
[   19.756226] br-lan: port 4(wl0-ap0) entered blocking state
[   19.761734] br-lan: port 4(wl0-ap0) entered forwarding state
[  711.802994] mt7530-mdio mdio-bus:00 lan2: Link is Down
[  711.813707] br-lan: port 2(lan2) entered disabled state

another maybe useful log

[    6.842201] kmodloader: done loading kernel modules from /etc/modules.d/*
[    6.900776] mt7622-wmac 18000000.wmac: HW/SW Version: 0x8a108a10, Build Time: 20190801210006a
[    6.900776] 
[    7.011235] mt7622-wmac 18000000.wmac: N9 Firmware Version: _reserved_, Build Time: 20220630094834

Lexeyko · April 2, 2024, 3:39pm

Do everything through XMiR-Patcher. Why continue to do something that you don’t understand when everything has already been thought up and done for you. Putting the firmware in a folder and pressing one button is much easier than writing memoirs here.

senso · April 22, 2024, 10:52pm

After all this back and forth, can I update my AX6S currently running OpenWrt SNAPSHOT r25132-dfc1e8cfee / LuCI Master git-24.040.70477-23ebdb3, kernel 5.15.148 or not?

Best regards.

alexanderk · April 24, 2024, 5:16am

Yesterday i bought 2 rb01 and tried to flash them.
One had 1.0.83 with telnet disabled.
Tried xmir patcher with no success.
Also tried xiaomi-enable-mesh-telnet.py and also no success.

Anyone can help? i have the output from xmir patcher

Xiaomi MiR Patcher

1 - Set IP-address (current value: 192.168.31.1)
2 - Connect to device (install exploit)
3 - Read full device info
4 - Create full backup
5 - Install EN/RU languages
6 - Install Breed bootloader
7 - Install firmware (from directory "firmware")
8 - {{{ Other functions }}}
9 - [[ Reboot device ]]
0 - Exit

Select: 2

device_name = RB01
rom_version = 1.0.83 release
mac address = 40:c2:ba:dd:85:7d
Enter device WEB password: test1234
Enable smartcontroller scene executor ...
Wait smartcontroller activation ...
Unlock dropbear service ...
Traceback (most recent call last):
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 699, in urlopen
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 445, in _make_request
File "", line 3, in raise_from
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 440, in _make_request
File "http\client.py", line 1344, in getresponse
File "http\client.py", line 307, in begin
File "http\client.py", line 276, in _read_status
http.client.RemoteDisconnected: Remote end closed connection without response

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "d:\python\python38\Lib\site-packages\requests/adapters.py", line 439, in send
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 755, in urlopen
File "d:\python\python38\Lib\site-packages\urllib3/util/retry.py", line 532, in increment
File "d:\python\python38\Lib\site-packages\urllib3/packages/six.py", line 769, in reraise
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 699, in urlopen
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 445, in _make_request
File "", line 3, in raise_from
File "d:\python\python38\Lib\site-packages\urllib3/connectionpool.py", line 440, in _make_request
File "http\client.py", line 1344, in getresponse
File "http\client.py", line 307, in begin
File "http\client.py", line 276, in _read_status
urllib3.exceptions.ProtocolError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\Downloads\xmir-patcher-main\connect5.py", line 77, in exec_smart_cmd
res = requests.post(gw.apiurl + api, data = { "payload": payload }, timeout = timeout)
File "d:\python\python38\Lib\site-packages\requests/api.py", line 117, in post
File "d:\python\python38\Lib\site-packages\requests/api.py", line 61, in request
File "d:\python\python38\Lib\site-packages\requests/sessions.py", line 542, in request
File "d:\python\python38\Lib\site-packages\requests/sessions.py", line 655, in send
File "d:\python\python38\Lib\site-packages\requests/adapters.py", line 498, in send
requests.exceptions.ConnectionError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "connect.py", line 59, in
import connect5
File "D:\Downloads\xmir-patcher-main\connect5.py", line 329, in
exec_cmd("sed -i 's/release/XXXXXX/g' /etc/init.d/dropbear")
File "D:\Downloads\xmir-patcher-main\connect5.py", line 220, in exec_cmd
exec_tiny_cmd(cmd)
File "D:\Downloads\xmir-patcher-main\connect5.py", line 137, in exec_tiny_cmd
res = exec_smart_cmd(pdata)
File "D:\Downloads\xmir-patcher-main\connect5.py", line 80, in exec_smart_cmd
raise ExploitError(f'Cannot send POST-request "{sc_command}" to SmartController service. {msg}')
connect5.ExploitError: Cannot send POST-request "scene_setting" to SmartController service. ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response'))

==========================================================

Xiaomi MiR Patcher

1 - Set IP-address (current value: 192.168.31.1)
2 - Connect to device (install exploit)
3 - Read full device info
4 - Create full backup
5 - Install EN/RU languages
6 - Install Breed bootloader
7 - Install firmware (from directory "firmware")
8 - {{{ Other functions }}}
9 - [[ Reboot device ]]
0 - Exit

Select:

nozombian · April 25, 2024, 8:46am

Hi, today I flashed 2 units of ax3200 with 1.0.83. I ordered them last week and both flashed fine with 23.05.3.

I wanted to prevent the chinese thing from calling home, so I recall having similar errors when I tried to flash my first device offline. For the first time when you run xmir-patcher, it needs to download some libraries from internet, so it is useful to make a dry run first with working internet without ax3200 connected.

You can also try to reset ax3200 and set it up again, xmir patcher needs a fully configured device, but it can be offline, none of my units ever phoned home You may also try to delete xmir-patcher and do a fresh git clone, but do not forget to make dry run first (without ax3200 connected) and let it download the libraries first. It downloads charset_normalizer, pyftpdlib, ssh2_python, etc... to function properly.

Xxyzzy · May 6, 2024, 7:23am

Anyone tested yet with a recent snapshot and 6.6 kernel ?

danpawlik · May 6, 2024, 9:19am

I'm using kernel 6.6 on that device for a while. I did not update to 6.6.30 yet.
Do you have any issue @Xxyzzy ?

Xxyzzy · May 6, 2024, 2:16pm

No issues. Just curious if I dare to upgrade from the 6.1 kernel

danpawlik · May 6, 2024, 2:17pm

yes, but be aware, that the new images are extending the kernel partition to be bigger - https://github.com/openwrt/openwrt/commit/a6991fc7d251f7ab65a588546e22abfd4f8ce472

Flash the factory image using mtd (provided by @rany2):

mount -o remount,ro /
mount -o remount,ro /overlay
cd /tmp
dd if=factory.bin bs=1M count=4 | mtd write - kernel
dd if=factory.bin bs=1M skip=4 | mtd -r write - ubi

Or, flash the 2nd u-boot via mtd and upload the firmware
to the 2nd u-boot using tftp:

1. prepare a tftp server at 192.168.1.254 to serve the
   sysupgrade image:
   openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-squashfs-sysupgrade.itb
2. upload the ubi-loader.itb to OpenWrt /tmp, and flash it to
   the old kernel partition:
   mtd -r write openwrt-mediatek-mt7622-xiaomi_redmi-router-ax6s-ubi-loader.itb
3. The router should reboot and flash the sysupgrade image via TFTP.

Procedure for flashing from vendor firmware shouldn't change.

You can try also via xmir patcher - https://github.com/openwrt-xiaomi/xmir-patcher

If you force flash the upgrade image, probably the router will not stand up, so you need to read the unbrick procedure - https://openwrt.org/toh/xiaomi/ax3200#debricking

PjV · May 7, 2024, 4:38pm

Well, I updated my ax3200 to the current snapshot, this morning.
I’m having 2.4GHz performance issues since then (less than 1Mb/s throughput).
5GHz works without issues > 50Mb/s (one floor up, about 6 meter distance.)

I’m going back to 5.23.3 now.

Edit: didn’t go back to 23.5.3, because I’m not sure how to do the downgrade.
Instead, I re-applied the snapshot. Speed is good now. (weird, but ok.)

greateconqueror · May 7, 2024, 5:42pm

for the current owners should I buy this device or go for the AX3000T?

danpawlik · May 7, 2024, 6:42pm

Dunno what is "morning" but if it is a snapshot base on ce4da3cf41 it should be fine.
I build images by my own and also from that commit, I got speed over 700mbit/s for 5GHz with 80MHz length.

PjV · May 7, 2024, 7:09pm

Hi, thanks.
I’m having issues with the 2.4 band, 5GHz seems to be fine.

My earlier edit that the re-applying of the snapshot fixed things was premature. The problem is back. Ping goes to > 300ms, throughput < 1Mb/s.
Not sure what made it re-appear, I only added the remaining previous APs.

Both wired and 5GHz are fine, it is just 2.4GHz that is giving problems.

ubus call system board

{
 	"kernel": “6.6.30”,
 	"hostname": “OpenWrt”,
 	"system": "ARMv8 Processor rev 4”,
 	"model": "Xiaomi Redmi Router AX6S”,
 	"board_name": "xiaomi,redmi-router-ax6s”,
 	"rootfs_type": “squashfs”,
 	"release": {
 		"distribution": “OpenWrt”,
 		"version": “SNAPSHOT”,
 		"revision": "r26207-ce4da3cf41”,
 		"target": "mediatek/mt7622”,
 		"description": "OpenWrt SNAPSHOT r26207-ce4da3cf41”
 	}
 }

Now I need to find out how to go back to 23.5.3.

danpawlik · May 7, 2024, 7:18pm

try to make a backup, then remove /etc/config/wireless, reboot and configure once again from scratch.
Some time ago, I got an issue also with 2.4GHz (after hostapd update or maybe mt76 update - don't remember exactly now) with my printer - it took ages before it starts printing (yes, only it uses 2.4GHz).

I remember that I was doing some changes, which was helpful:

        option rts '256' #  (was working better then when I tried 2340)
        option frag '768' # (was working better then when I tried 2340)
        (...)
        option wnm_sleep_mode '1'
        option bss_transition '1'
        option dtim_period '1

But before you will try to change something, better try to cleanup config and setup from scratch. Good luck!
Here is my build, if you want to try: https://github.com/danpawlik/openwrt/releases/tag/hw-offload-2

PjV · May 8, 2024, 9:03am

Thanks, I checked the config/wireless file and it is very clean.

I’m not sure what is wrong, my android devices don’t want to connect on 2.4GHz, you see trying a few times and giving up after trying to get an IP Address.
I now have only one AP on 2.4GHz, for my Sonos (mediaplayer -really old- it only has 2.4GHz). It works OK, speed seems to be OK too.
All other APs are now moved to 5GHz and work fine too.
I will leave it like this for a few days (previously I had more 2.4GHz APs because of the larger range).
The 5GHz radio is on channel 112 and with 20MHz width, I can go up to 400mW with this firmware.

sencha · May 8, 2024, 2:39pm

Result of all the three checks during stock fw was 0 , so I flashed openwrt using the older bootloader procedure.

I have installed Openwrt, after 7 reboots the router stopped booting.

The orange led is flashing slowly (4 seconds on, 1 second off), every few seconds briefly flashes blue led.

xabolcs · May 8, 2024, 3:44pm

When you are done with debricking put a few fw_setenv command in /etc/rc.local:

# to select slot 0, only need to set once ;)
fw_setenv flag_last_success 0

# to reset "try counters" for slot 0 and slot 1
fw_setenv flag_try_sys1_failed 0
fw_setenv flag_try_sys2_failed 0

It will do the trick to survive 7 reboots.

And to verify if you have 2022 or newer U-Boot, just grep for it in the u-boot partition:

root@OpenWrt:/# grep ^U-Boot /dev/mtd2
U-Boot
U-Boot console
U-Boot
U-Boot BUG at %s:%d!
U-Boot 2014.04-rc1 (May 20 2022 - 10:19:21)

root@OpenWrt:/# grep mtd2 /proc/mtd
mtd2: 00080000 00020000 "u-boot"

sencha · May 8, 2024, 8:48pm

Is it compulsory to update the rc.local , could the following Openwrt release include the update?

xabolcs · May 8, 2024, 10:17pm

That /etc/rc.local is included in the backup when you keep your settings while sysupgrade-ing. You can check it by sysupgrade --list-backup.

It's just a local workaround what you have to manage yourself: keep it with sysupgrade and redo on clean install.

Sure, one could upstream this workaround to OpenWrt's bootcount script, but I'm too lazy to do it now.

buz · May 9, 2024, 5:54am

Mine has an earlier one:

U-Boot 2014.04-rc1 (Sep 03 2021 - 08:42:53)

Do I need to update to prevent it bricking itself at some point despite the rc.local change?