Actually mine has been booted at most twice as I took it from storage only last week
I had some more devices that need the 2.4GHz and fail to connect to this firmware (Garmin watch, Google Chromecast), so I need to downgrade to 23.5.3.
What would be the correct way to do that?
The instructions I initially used fail:
dd if=factory.bin bs=1M count=4 | mtd write - kernel
Could not open mtd device: kernel
Can't open device for writing!
My AX6s has the new uboot:
grep ^U-Boot /dev/mtd2
U-Boot
U-Boot console
U-Boot
U-Boot BUG at %s:%d!
U-Boot 2014.04-rc1 (May 20 2022 - 10:19:21)
Luci warns me that the sysupgrade.bin file is incompatible:
The device is supported, but this image is incompatible for sysupgrade based on the image version (2.0->1.0). Invalid image type. Image check failed.
The uploaded image file does not contain a supported format. Make sure that you choose the generic image format for your platform.
What would be the correct way to do the downgrade to 23.5.3?
Would be helpful if you provide:
ubus call system board
uci export network;
uci export wireless;
dmesg
logread
and/or if you can set log_level to the problematic network e.g.:
uci set wireless.default_radio1.log_level=0
uci commit wireless
<reboot router or restart httpd>
and share the logs when the device is trying to connect and it can't - that would be really appreciated.
If you want to go back (I never have done it before) - best way would be do same procedure as with debrick
Here is a part of logread, after setting loglevel of radio0:
Thu May 9 15:23:23 2024 daemon.notice hostapd: wl0-ap0: interface state ENABLED->DISABLED
Thu May 9 15:23:23 2024 daemon.notice hostapd: wl0-ap0: AP-DISABLED
Thu May 9 15:23:23 2024 daemon.notice hostapd: wl0-ap0: CTRL-EVENT-TERMINATING
Thu May 9 15:23:23 2024 daemon.err hostapd: rmdir[ctrl_interface=/var/run/hostapd]: Permission denied
Thu May 9 15:23:23 2024 daemon.notice hostapd: nl80211: deinit ifname=wl0-ap0 disabled_11b_rates=0
Thu May 9 15:23:23 2024 kern.info kernel: [ 1006.631747] mt7622-wmac 18000000.wmac wl0-ap0: left allmulticast mode
Thu May 9 15:23:23 2024 kern.info kernel: [ 1006.638216] mt7622-wmac 18000000.wmac wl0-ap0: left promiscuous mode
Thu May 9 15:23:23 2024 kern.info kernel: [ 1006.644694] br-lanTest: port 1(wl0-ap0) entered disabled state
Thu May 9 15:23:23 2024 daemon.notice netifd: Network device 'wl0-ap0' link is down
Thu May 9 15:23:23 2024 daemon.notice wpa_supplicant[1648]: Set new config for phy wl0
Thu May 9 15:23:23 2024 daemon.notice netifd: Wireless device 'radio0' is now down
Thu May 9 15:23:23 2024 daemon.notice netifd: radio0 (5677): WARNING: Variable 'data' does not exist or is not an array/object
Thu May 9 15:23:23 2024 daemon.notice hostapd: Set new config for phy wl0:
Thu May 9 15:23:23 2024 daemon.notice wpa_supplicant[1648]: Set new config for phy wl0
Thu May 9 15:23:23 2024 daemon.notice wpa_supplicant[1648]: Set new config for phy wl0
Thu May 9 15:23:23 2024 daemon.notice hostapd: Set new config for phy wl0: /var/run/hostapd-wl0.conf
Thu May 9 15:23:23 2024 daemon.notice hostapd: Restart interface for phy wl0
Thu May 9 15:23:23 2024 daemon.notice hostapd: Configuration file: data: driver=nl80211 logger_syslog=127 logger_syslog_level=2 logger_stdout=127 logger_stdout_level=2 country_code=NL ieee80211d=1 hw_mode=g beacon_int=100 chanlist=7 #num_global_macaddr=1 ieee80211n=1 ht_coex=0 ht_capab=[LDPC][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC1] channel=7 interface=wl0-ap0 bssid=26:eb:28:71:38:71 ctrl_interface=/var/run/hostapd ap_isolate=1 bss_load_update_period=60 chan_util_avg_period=600 disassoc_low_ack=1 skip_inactivity_poll=1 preamble=1 wmm_enabled=0 ignore_broadcast_ssid=0 uapsd_advertisement_enabled=1 utf8_ssid=1 multi_ap=0 wpa_passphrase=**** wpa_psk_file=/var/run/hostapd-wl0-ap0.psk auth_algs=1 wpa=2 wpa_pairwise=CCMP ssid=APTest bridge=br-lanTest wds_bridge= snoop_iface=br-lanTest wpa_disable_eapol_key_retries=0 wpa_key_mgmt=WPA-PSK okc=0 disable_pmksa_caching=1 dynamic_vlan=0 vlan_naming=1 vlan_no_bridge=1 vlan_file=/var/run/hostapd-wl0-ap0.vlan qos_map_set=0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56 nas_iden
Thu May 9 15:23:23 2024 daemon.notice netifd: Wireless device 'radio0' is now up
Thu May 9 15:23:23 2024 kern.info kernel: [ 1007.506487] br-lanTest: port 1(wl0-ap0) entered blocking state
Thu May 9 15:23:23 2024 kern.info kernel: [ 1007.512517] br-lanTest: port 1(wl0-ap0) entered disabled state
Thu May 9 15:23:23 2024 kern.info kernel: [ 1007.518489] mt7622-wmac 18000000.wmac wl0-ap0: entered allmulticast mode
Thu May 9 15:23:24 2024 kern.info kernel: [ 1007.525434] mt7622-wmac 18000000.wmac wl0-ap0: entered promiscuous mode
Thu May 9 15:23:24 2024 kern.info kernel: [ 1007.532231] br-lanTest: port 1(wl0-ap0) entered blocking state
Thu May 9 15:23:24 2024 kern.info kernel: [ 1007.538150] br-lanTest: port 1(wl0-ap0) entered forwarding state
Thu May 9 15:23:24 2024 daemon.notice hostapd: wl0-ap0: interface state UNINITIALIZED->COUNTRY_UPDATE
Thu May 9 15:23:24 2024 daemon.notice netifd: Network device 'wl0-ap0' link is up
Thu May 9 15:23:24 2024 daemon.notice hostapd: wl0-ap0: interface state COUNTRY_UPDATE->ENABLED
Thu May 9 15:23:24 2024 daemon.notice hostapd: wl0-ap0: AP-ENABLED
Thu May 9 15:24:05 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: authenticated
Thu May 9 15:24:12 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: authenticated
Thu May 9 15:24:22 2024 daemon.notice hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: did not acknowledge authentication response
Thu May 9 15:24:25 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: authenticated
Thu May 9 15:24:32 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: authenticated
Thu May 9 15:24:35 2024 daemon.notice hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: did not acknowledge authentication response
Thu May 9 15:24:35 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: associated (aid 1)
Thu May 9 15:24:37 2024 daemon.notice hostapd: wl0-ap0: AP-STA-CONNECTED 1e:56:4a:65:e0:18 auth_alg=open
Thu May 9 15:24:37 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 WPA: pairwise key handshake completed (RSN)
Thu May 9 15:24:37 2024 daemon.notice hostapd: wl0-ap0: EAPOL-4WAY-HS-COMPLETED 1e:56:4a:65:e0:18
I have gone back to a previous snapshot (dated april 8th):
ubus call system board
{
"kernel": “6.1.82”,
"hostname": “OpenWrt”,
"system": "ARMv8 Processor rev 4”,
"model": "Xiaomi Redmi Router AX6S”,
"board_name": "xiaomi,redmi-router-ax6s”,
"rootfs_type": “squashfs”,
"release": {
"distribution": “OpenWrt”,
"version": “SNAPSHOT”,
"revision": "r25856-6512333518”,
"target": "mediatek/mt7622”,
"description": "OpenWrt SNAPSHOT r25856-6512333518”
}
}
Now 2.4GHz works again.
Do you have any Huwaei inverter for solar panels ? There is a known issue with inverters causing 2.4Ghz band to be stuck at 1Mbps when the inverter is connected (not specific to the AX6S).
Hi,
We don’t have solar panels here.
I have solved it by downgrading from the recent 6.6.30 based snapshot to an older 6.1.82 based snapshot.
I’m curious if others will report the same issue using the 2.4GHz band.
What if the count keeps increasing?
Then something is messed up with your fw_setenv commands.
My /etc/rc.local is below:
# Put your custom commands here that should be executed once
# the system init finished. By default this file does nothing.
# use slot 0, to be sure ;)
fw_setenv flag_last_success 0
# to survive 7 reboots with U-Boot 2014.04-rc1 (May 20 2022 - 10:19:21) or newer
fw_setenv flag_try_sys1_failed 0
fw_setenv flag_try_sys2_failed 0
exit 0What I mean is, if the change you suggest is not applied and count keeps increasing, could it stop booting?
Yes, it would softbrick the device: when flag_try_sys1_failed=7 then the bootloader switches autoboot from slot 0 to slot 1 and get stucked in boot-loop.
If you have serial access, then simply booting from slot 0 and setting those flags will restore normal boot.
flag_try_sys1_failed=12
flag_try_sys2_failed=8
Openwrt boots, but flag_try_sys1_failed keeps increasing by 1 on each boot, could it become an issue later?
1 Like
If it passed 7 then it won't hurt! 
Would you mind showing all your flag? Simply fw_getenv fw_printenv | grep flag would do it!
1 Like
flag_boot_rootfs=0
flag_boot_success=1
flag_boot_type=2
flag_last_success=1
flag_ota_reboot=0
flag_try_sys1_failed=13
flag_try_sys2_failed=8
Thank you!
Now I was able to test the new U-Boot (2022+) behavior:
flag_try_sys2_failed>= 6 andflag_last_success= 1 results booting from slot 0 andflag_try_sys1_failedincreasing till it overflows after 2^32-1 and continues at 0flag_try_sys2_failed< 6 andflag_last_success= 1 results booting from slot 1
withflag_try_sys2_failedincreasing till it reaches 6
It's the same with slot 0, just mirrored:
flag_try_sys1_failed>= 6 andflag_last_success= 0 results booting from slot 1 withflag_try_sys2_failedincreasing till it overflows after 2^32-1 and continues at 0flag_try_sys1_failed< 6 andflag_last_success= 0 results booting from slot 0 withflag_try_sys1_failedincreasing till 6
So without that /etc/rc.local workaround it's safer to stick to flag_last_success=1 as it will automatically fix itself after 6 reboots when those try_sys flags got lower than 6.
2 Likes
Thorough 
Hi,
I have RA80 Xiaomi AX3000 router using 1.0.46 firmware. Currently it is working in a xiaomi mesh mode. I was able to gain ssh access to it using patcher.
Router has openwrt from factory
root@XiaoQiang:~# cat /etc/openwrt_release
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='18.06-SNAPSHOT'
DISTRIB_REVISION='unknown'
DISTRIB_TARGET='ipq/ipq50xx'
DISTRIB_ARCH='arm_cortex-a7'
DISTRIB_DESCRIPTION='OpenWrt 18.06-SNAPSHOT unknown'
DISTRIB_TAINTS='no-all busybox'
NVRam params:
ipaddr=192.168.31.1
serverip=192.168.31.100
flag_boot_rootfs=1
flag_boot_type=2
flag_last_success=1
flag_ota_reboot=0
flag_boot_success=1
flag_try_sys1_failed=0
flag_try_sys2_failed=0
flag_show_upgrade_info=0
Kernel command line:
ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs cnss2.bdf_integrated=0x24 cnss2.bdf_pci0=0x60 cnss2.bdf_pci1=0x60 cnss2.skip_radio_bmap=4 rootwait uart_en=1 swiotlb=1
RootFS info:
num = 1
mtd_num = None
mtd_dev = "None"
partition = "rootfs_1"
Base info:
Linux version: None
DISTRIB_TARGET = ipq/ipq50xx
DISTRIB_ARCH = arm_cortex-a7
CPU arch: armv7
CPU name: ipq50xx
Version info:
UBoot: None
OpenWrt: unknown
Firmware: 1.0.46
Channel: release
BuildTime: Mon, 30 Jan 2023 07:08:47 +0000
Hardware: RA80
UBoot(2): 1.0.2
MTD partitions:
0 > addr: 0x00000000 size: 0x00080000 ro:0 name: "0:SBL1"
1 > addr: 0x00080000 size: 0x00080000 ro:0 name: "0:MIBIB"
2 > addr: 0x00100000 size: 0x00040000 ro:0 name: "0:BOOTCONFIG"
3 > addr: 0x00140000 size: 0x00040000 ro:0 name: "0:BOOTCONFIG1"
4 > addr: 0x00180000 size: 0x00100000 ro:0 name: "0:QSEE"
5 > addr: 0x00280000 size: 0x00100000 ro:0 name: "0:QSEE_1"
6 > addr: 0x00380000 size: 0x00040000 ro:0 name: "0:DEVCFG"
7 > addr: 0x003C0000 size: 0x00040000 ro:0 name: "0:DEVCFG_1"
8 > addr: 0x00400000 size: 0x00040000 ro:0 name: "0:CDT"
9 > addr: 0x00440000 size: 0x00040000 ro:0 name: "0:CDT_1"
10 > addr: 0x00480000 size: 0x00080000 ro:0 name: "0:APPSBLENV"
11 > addr: 0x00500000 size: 0x00140000 ro:0 name: "0:APPSBL"
12 > addr: 0x00640000 size: 0x00140000 ro:0 name: "0:APPSBL_1"
13 > addr: 0x00780000 size: 0x00100000 ro:0 name: "0:ART"
14 > addr: 0x00880000 size: 0x00080000 ro:0 name: "0:TRAINING"
15 > addr: 0x00900000 size: 0x00080000 ro:0 name: "bdata"
16 > addr: 0x00980000 size: 0x00080000 ro:0 name: "crash"
17 > addr: 0x00A00000 size: 0x00080000 ro:0 name: "crash_syslog"
18 > addr: 0x00A80000 size: 0x02400000 ro:0 name: "rootfs"
19 > addr: 0x02E80000 size: 0x02400000 ro:0 name: "rootfs_1"
20 > addr: 0x05280000 size: 0x01F00000 ro:0 name: "overlay"
21 > addr: 0x07180000 size: 0x00080000 ro:0 name: "rsvd0"
22 > addr: 0xFFFFFFFF size: 0x00364000 ro:0 name: "kernel"
23 > addr: 0xFFFFFFFF size: 0x0120B000 ro:0 name: "ubi_rootfs"
24 > addr: 0xFFFFFFFF size: 0x01B20000 ro:0 name: "data"
I bought new openwrt router and I would like to pair it with my existing xiaomi routers.
I need this as I have poe switch that is connected to wifi using xiaomi mesh mode.
I'm not sure should I install openwrt firmware, as it already has it, or upgrade it and install adition packages in this router.
This is router meminfo
root@XiaoQiang:~# cat /proc/meminfo
MemTotal: 183076 kB
MemFree: 43356 kB
MemAvailable: 41176 kB
Buffers: 5884 kB
Cached: 30324 kB
SwapCached: 0 kB
Active: 30176 kB
Inactive: 11524 kB
Active(anon): 7544 kB
Inactive(anon): 1668 kB
Active(file): 22632 kB
Inactive(file): 9856 kB
Unevictable: 1008 kB
Mlocked: 0 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 6500 kB
Mapped: 12468 kB
Shmem: 2712 kB
Slab: 57472 kB
SReclaimable: 4108 kB
SUnreclaim: 53364 kB
KernelStack: 960 kB
PageTables: 580 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 91536 kB
Committed_AS: 17604 kB
VmallocTotal: 1818624 kB
VmallocUsed: 0 kB
VmallocChunk: 0 kB
Good results, but wrong thread!
Maybe this one is yours?
Yeah, I realized that after posting but I couldn't move it and didn't want to delete it.
Anyway I managed to convert router to openwrt. As I done it, I will briefly describe process. While flashing firmware my router was mesh node in xiaomi mesh.
I used this patcher to gain ssh access to router. Permanent access is also available.
In ~/.ssh/ create file named config and add to it
HostKeyAlgorithms = +ssh-rsa
PubkeyAcceptedAlgorithms = +ssh-rsa
After that you can ssh root@router_ip. Password is root.
I grabed firmware from this github repo. On the bottom of the page there are instructions in
Use miwifi (the vendor firmware) to flash
I tried to wget or curl this image from the router but no success. It will download empty file. I download it to my computer and done
scp *.ubi root@192.168.31.145:/tmp
Firmware is now copied to router /tmp directory. In that directory check curremt system slot like described in firmware repo and just run ubiformat on another slot.
Also after flashing run nvram commands and reboot router.
And that was it. Openwrt is installed on AX3000 RA80 Chinese model.
The only thing I noticed so far is that I get empty 5Ghz wifi on scanning but maybe some additional config should be used.
I have tried to use attended sysupgrade and I'm getting this error:
Sun May 26 21:14:40 2024 user.info upgrade: The device is supported, but this image is incompatible for sysupgrade based on the image version (1.0->2.0).
Sun May 26 21:14:40 2024 user.info upgrade: Flash layout changes require a manual reinstall using factory.bin.
Can I just download the factory.bin file from the firmware selector page, or do I need to do something else, I have seen references to changing settings on the bootloader to prevent boot loops, but this thread is a bit messy with posts about the AX6S and the AX3000 router..
Best regards.