Adding OpenWrt support for Xiaomi "Redmi Router AX6S"/"Xiaomi Router AX3200"

You don't have to!

Check their values! They should be above 7 already!

root@OpenWrt:/# fw_printenv | grep -e flag_try_sys
flag_try_sys2_failed=0
flag_try_sys1_failed=0

Actually mine has been booted at most twice as I took it from storage only last week

I had some more devices that need the 2.4GHz and fail to connect to this firmware (Garmin watch, Google Chromecast), so I need to downgrade to 23.5.3.
What would be the correct way to do that?

The instructions I initially used fail:

dd if=factory.bin bs=1M count=4 | mtd write - kernel
Could not open mtd device: kernel
Can't open device for writing!

My AX6s has the new uboot:

grep ^U-Boot /dev/mtd2
U-Boot
U-Boot console
U-Boot
U-Boot BUG at %s:%d!
U-Boot 2014.04-rc1 (May 20 2022 - 10:19:21)

Luci warns me that the sysupgrade.bin file is incompatible:

The device is supported, but this image is incompatible for sysupgrade based on the image version (2.0->1.0). Invalid image type. Image check failed.

The uploaded image file does not contain a supported format. Make sure that you choose the generic image format for your platform.

What would be the correct way to do the downgrade to 23.5.3?

Would be helpful if you provide:

ubus call system board
uci export network;
uci export wireless; 
dmesg
logread

and/or if you can set log_level to the problematic network e.g.:

uci set wireless.default_radio1.log_level=0
uci commit wireless
<reboot router or restart httpd>

and share the logs when the device is trying to connect and it can't - that would be really appreciated.

If you want to go back (I never have done it before) - best way would be do same procedure as with debrick

Here is a part of logread, after setting loglevel of radio0:

Thu May  9 15:23:23 2024 daemon.notice hostapd: wl0-ap0: interface state ENABLED->DISABLED
Thu May  9 15:23:23 2024 daemon.notice hostapd: wl0-ap0: AP-DISABLED
Thu May  9 15:23:23 2024 daemon.notice hostapd: wl0-ap0: CTRL-EVENT-TERMINATING
Thu May  9 15:23:23 2024 daemon.err hostapd: rmdir[ctrl_interface=/var/run/hostapd]: Permission denied
Thu May  9 15:23:23 2024 daemon.notice hostapd: nl80211: deinit ifname=wl0-ap0 disabled_11b_rates=0
Thu May  9 15:23:23 2024 kern.info kernel: [ 1006.631747] mt7622-wmac 18000000.wmac wl0-ap0: left allmulticast mode
Thu May  9 15:23:23 2024 kern.info kernel: [ 1006.638216] mt7622-wmac 18000000.wmac wl0-ap0: left promiscuous mode
Thu May  9 15:23:23 2024 kern.info kernel: [ 1006.644694] br-lanTest: port 1(wl0-ap0) entered disabled state
Thu May  9 15:23:23 2024 daemon.notice netifd: Network device 'wl0-ap0' link is down
Thu May  9 15:23:23 2024 daemon.notice wpa_supplicant[1648]: Set new config for phy wl0
Thu May  9 15:23:23 2024 daemon.notice netifd: Wireless device 'radio0' is now down
Thu May  9 15:23:23 2024 daemon.notice netifd: radio0 (5677): WARNING: Variable 'data' does not exist or is not an array/object
Thu May  9 15:23:23 2024 daemon.notice hostapd: Set new config for phy wl0:
Thu May  9 15:23:23 2024 daemon.notice wpa_supplicant[1648]: Set new config for phy wl0
Thu May  9 15:23:23 2024 daemon.notice wpa_supplicant[1648]: Set new config for phy wl0
Thu May  9 15:23:23 2024 daemon.notice hostapd: Set new config for phy wl0: /var/run/hostapd-wl0.conf
Thu May  9 15:23:23 2024 daemon.notice hostapd: Restart interface for phy wl0
Thu May  9 15:23:23 2024 daemon.notice hostapd: Configuration file: data: driver=nl80211 logger_syslog=127 logger_syslog_level=2 logger_stdout=127 logger_stdout_level=2 country_code=NL ieee80211d=1 hw_mode=g beacon_int=100 chanlist=7 #num_global_macaddr=1 ieee80211n=1 ht_coex=0 ht_capab=[LDPC][SHORT-GI-20][SHORT-GI-40][TX-STBC][RX-STBC1] channel=7  interface=wl0-ap0 bssid=26:eb:28:71:38:71 ctrl_interface=/var/run/hostapd ap_isolate=1 bss_load_update_period=60 chan_util_avg_period=600 disassoc_low_ack=1 skip_inactivity_poll=1 preamble=1 wmm_enabled=0 ignore_broadcast_ssid=0 uapsd_advertisement_enabled=1 utf8_ssid=1 multi_ap=0 wpa_passphrase=**** wpa_psk_file=/var/run/hostapd-wl0-ap0.psk auth_algs=1 wpa=2 wpa_pairwise=CCMP ssid=APTest bridge=br-lanTest wds_bridge= snoop_iface=br-lanTest wpa_disable_eapol_key_retries=0 wpa_key_mgmt=WPA-PSK okc=0 disable_pmksa_caching=1 dynamic_vlan=0 vlan_naming=1 vlan_no_bridge=1 vlan_file=/var/run/hostapd-wl0-ap0.vlan qos_map_set=0,0,2,16,1,1,255,255,18,22,24,38,40,40,44,46,48,56 nas_iden
Thu May  9 15:23:23 2024 daemon.notice netifd: Wireless device 'radio0' is now up
Thu May  9 15:23:23 2024 kern.info kernel: [ 1007.506487] br-lanTest: port 1(wl0-ap0) entered blocking state
Thu May  9 15:23:23 2024 kern.info kernel: [ 1007.512517] br-lanTest: port 1(wl0-ap0) entered disabled state
Thu May  9 15:23:23 2024 kern.info kernel: [ 1007.518489] mt7622-wmac 18000000.wmac wl0-ap0: entered allmulticast mode
Thu May  9 15:23:24 2024 kern.info kernel: [ 1007.525434] mt7622-wmac 18000000.wmac wl0-ap0: entered promiscuous mode
Thu May  9 15:23:24 2024 kern.info kernel: [ 1007.532231] br-lanTest: port 1(wl0-ap0) entered blocking state
Thu May  9 15:23:24 2024 kern.info kernel: [ 1007.538150] br-lanTest: port 1(wl0-ap0) entered forwarding state
Thu May  9 15:23:24 2024 daemon.notice hostapd: wl0-ap0: interface state UNINITIALIZED->COUNTRY_UPDATE
Thu May  9 15:23:24 2024 daemon.notice netifd: Network device 'wl0-ap0' link is up
Thu May  9 15:23:24 2024 daemon.notice hostapd: wl0-ap0: interface state COUNTRY_UPDATE->ENABLED
Thu May  9 15:23:24 2024 daemon.notice hostapd: wl0-ap0: AP-ENABLED
Thu May  9 15:24:05 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: authenticated
Thu May  9 15:24:12 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: authenticated
Thu May  9 15:24:22 2024 daemon.notice hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: did not acknowledge authentication response
Thu May  9 15:24:25 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: authenticated
Thu May  9 15:24:32 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: authenticated
Thu May  9 15:24:35 2024 daemon.notice hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: did not acknowledge authentication response
Thu May  9 15:24:35 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 IEEE 802.11: associated (aid 1)
Thu May  9 15:24:37 2024 daemon.notice hostapd: wl0-ap0: AP-STA-CONNECTED 1e:56:4a:65:e0:18 auth_alg=open
Thu May  9 15:24:37 2024 daemon.info hostapd: wl0-ap0: STA 1e:56:4a:65:e0:18 WPA: pairwise key handshake completed (RSN)
Thu May  9 15:24:37 2024 daemon.notice hostapd: wl0-ap0: EAPOL-4WAY-HS-COMPLETED 1e:56:4a:65:e0:18

I have gone back to a previous snapshot (dated april 8th):

ubus call system board
{
	"kernel": “6.1.82”,
	"hostname": “OpenWrt”,
	"system": "ARMv8 Processor rev 4”,
	"model": "Xiaomi Redmi Router AX6S”,
	"board_name": "xiaomi,redmi-router-ax6s”,
	"rootfs_type": “squashfs”,
	"release": {
		"distribution": “OpenWrt”,
		"version": “SNAPSHOT”,
		"revision": "r25856-6512333518”,
		"target": "mediatek/mt7622”,
		"description": "OpenWrt SNAPSHOT r25856-6512333518”
	}
}

Now 2.4GHz works again.

Do you have any Huwaei inverter for solar panels ? There is a known issue with inverters causing 2.4Ghz band to be stuck at 1Mbps when the inverter is connected (not specific to the AX6S).

Hi,

We don’t have solar panels here.
I have solved it by downgrading from the recent 6.6.30 based snapshot to an older 6.1.82 based snapshot.
I’m curious if others will report the same issue using the 2.4GHz band.

What if the count keeps increasing?

Then something is messed up with your fw_setenv commands.

My /etc/rc.local is below:

# Put your custom commands here that should be executed once
# the system init finished. By default this file does nothing.

# use slot 0, to be sure ;)
fw_setenv flag_last_success 0

# to survive 7 reboots with U-Boot 2014.04-rc1 (May 20 2022 - 10:19:21) or newer
fw_setenv flag_try_sys1_failed 0
fw_setenv flag_try_sys2_failed 0

exit 0

What I mean is, if the change you suggest is not applied and count keeps increasing, could it stop booting?

Yes, it would softbrick the device: when flag_try_sys1_failed=7 then the bootloader switches autoboot from slot 0 to slot 1 and get stucked in boot-loop.

If you have serial access, then simply booting from slot 0 and setting those flags will restore normal boot.

flag_try_sys1_failed=12
flag_try_sys2_failed=8

Openwrt boots, but flag_try_sys1_failed keeps increasing by 1 on each boot, could it become an issue later?

1 Like

If it passed 7 then it won't hurt! :slight_smile:

Would you mind showing all your flag? Simply fw_getenv fw_printenv | grep flag would do it!

1 Like
flag_boot_rootfs=0
flag_boot_success=1
flag_boot_type=2
flag_last_success=1
flag_ota_reboot=0
flag_try_sys1_failed=13
flag_try_sys2_failed=8

Thank you!

Now I was able to test the new U-Boot (2022+) behavior:

  • flag_try_sys2_failed >= 6 and flag_last_success = 1 results booting from slot 0 and flag_try_sys1_failed increasing till it overflows after 2^32-1 and continues at 0
  • flag_try_sys2_failed < 6 and flag_last_success = 1 results booting from slot 1
    with flag_try_sys2_failed increasing till it reaches 6 :wink:

It's the same with slot 0, just mirrored:

  • flag_try_sys1_failed >= 6 and flag_last_success = 0 results booting from slot 1 with flag_try_sys2_failed increasing till it overflows after 2^32-1 and continues at 0
  • flag_try_sys1_failed < 6 and flag_last_success = 0 results booting from slot 0 with flag_try_sys1_failed increasing till 6 :slight_smile:

So without that /etc/rc.local workaround it's safer to stick to flag_last_success=1 as it will automatically fix itself after 6 reboots when those try_sys flags got lower than 6.

1 Like

Thorough :+1:

Hi,
I have RA80 Xiaomi AX3000 router using 1.0.46 firmware. Currently it is working in a xiaomi mesh mode. I was able to gain ssh access to it using patcher.
Router has openwrt from factory

root@XiaoQiang:~# cat /etc/openwrt_release
DISTRIB_ID='OpenWrt'
DISTRIB_RELEASE='18.06-SNAPSHOT'
DISTRIB_REVISION='unknown'
DISTRIB_TARGET='ipq/ipq50xx'
DISTRIB_ARCH='arm_cortex-a7'
DISTRIB_DESCRIPTION='OpenWrt 18.06-SNAPSHOT unknown'
DISTRIB_TAINTS='no-all busybox'
NVRam params:
  ipaddr=192.168.31.1
  serverip=192.168.31.100
  flag_boot_rootfs=1
  flag_boot_type=2
  flag_last_success=1
  flag_ota_reboot=0
  flag_boot_success=1
  flag_try_sys1_failed=0
  flag_try_sys2_failed=0
  flag_show_upgrade_info=0

Kernel command line:
  ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs cnss2.bdf_integrated=0x24 cnss2.bdf_pci0=0x60 cnss2.bdf_pci1=0x60 cnss2.skip_radio_bmap=4 rootwait uart_en=1 swiotlb=1
RootFS info:
  num = 1
  mtd_num = None
  mtd_dev = "None"
  partition = "rootfs_1"
 
Base info:
  Linux version: None
  DISTRIB_TARGET = ipq/ipq50xx
  DISTRIB_ARCH = arm_cortex-a7
  CPU arch: armv7
  CPU name: ipq50xx
 
Version info:
  UBoot: None
  OpenWrt: unknown
  Firmware: 1.0.46
  Channel: release
  BuildTime: Mon, 30 Jan 2023 07:08:47 +0000
  Hardware: RA80
  UBoot(2): 1.0.2

MTD partitions:
   0 > addr: 0x00000000  size: 0x00080000  ro:0  name: "0:SBL1"
   1 > addr: 0x00080000  size: 0x00080000  ro:0  name: "0:MIBIB"
   2 > addr: 0x00100000  size: 0x00040000  ro:0  name: "0:BOOTCONFIG"
   3 > addr: 0x00140000  size: 0x00040000  ro:0  name: "0:BOOTCONFIG1"
   4 > addr: 0x00180000  size: 0x00100000  ro:0  name: "0:QSEE"
   5 > addr: 0x00280000  size: 0x00100000  ro:0  name: "0:QSEE_1"
   6 > addr: 0x00380000  size: 0x00040000  ro:0  name: "0:DEVCFG"
   7 > addr: 0x003C0000  size: 0x00040000  ro:0  name: "0:DEVCFG_1"
   8 > addr: 0x00400000  size: 0x00040000  ro:0  name: "0:CDT"
   9 > addr: 0x00440000  size: 0x00040000  ro:0  name: "0:CDT_1"
  10 > addr: 0x00480000  size: 0x00080000  ro:0  name: "0:APPSBLENV"
  11 > addr: 0x00500000  size: 0x00140000  ro:0  name: "0:APPSBL"
  12 > addr: 0x00640000  size: 0x00140000  ro:0  name: "0:APPSBL_1"
  13 > addr: 0x00780000  size: 0x00100000  ro:0  name: "0:ART"
  14 > addr: 0x00880000  size: 0x00080000  ro:0  name: "0:TRAINING"
  15 > addr: 0x00900000  size: 0x00080000  ro:0  name: "bdata"
  16 > addr: 0x00980000  size: 0x00080000  ro:0  name: "crash"
  17 > addr: 0x00A00000  size: 0x00080000  ro:0  name: "crash_syslog"
  18 > addr: 0x00A80000  size: 0x02400000  ro:0  name: "rootfs"
  19 > addr: 0x02E80000  size: 0x02400000  ro:0  name: "rootfs_1"
  20 > addr: 0x05280000  size: 0x01F00000  ro:0  name: "overlay"
  21 > addr: 0x07180000  size: 0x00080000  ro:0  name: "rsvd0"
  22 > addr: 0xFFFFFFFF  size: 0x00364000  ro:0  name: "kernel"
  23 > addr: 0xFFFFFFFF  size: 0x0120B000  ro:0  name: "ubi_rootfs"
  24 > addr: 0xFFFFFFFF  size: 0x01B20000  ro:0  name: "data"

I bought new openwrt router and I would like to pair it with my existing xiaomi routers.
I need this as I have poe switch that is connected to wifi using xiaomi mesh mode.
I'm not sure should I install openwrt firmware, as it already has it, or upgrade it and install adition packages in this router.
This is router meminfo

root@XiaoQiang:~# cat /proc/meminfo
MemTotal:         183076 kB
MemFree:           43356 kB
MemAvailable:      41176 kB
Buffers:            5884 kB
Cached:            30324 kB
SwapCached:            0 kB
Active:            30176 kB
Inactive:          11524 kB
Active(anon):       7544 kB
Inactive(anon):     1668 kB
Active(file):      22632 kB
Inactive(file):     9856 kB
Unevictable:        1008 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          6500 kB
Mapped:            12468 kB
Shmem:              2712 kB
Slab:              57472 kB
SReclaimable:       4108 kB
SUnreclaim:        53364 kB
KernelStack:         960 kB
PageTables:          580 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       91536 kB
Committed_AS:      17604 kB
VmallocTotal:    1818624 kB
VmallocUsed:           0 kB
VmallocChunk:          0 kB

Good results, but wrong thread!

Maybe this one is yours?

Yeah, I realized that after posting but I couldn't move it and didn't want to delete it.
Anyway I managed to convert router to openwrt. As I done it, I will briefly describe process. While flashing firmware my router was mesh node in xiaomi mesh.

I used this patcher to gain ssh access to router. Permanent access is also available.
In ~/.ssh/ create file named config and add to it

HostKeyAlgorithms = +ssh-rsa
PubkeyAcceptedAlgorithms = +ssh-rsa

After that you can ssh root@router_ip. Password is root.
I grabed firmware from this github repo. On the bottom of the page there are instructions in

Use miwifi (the vendor firmware) to flash

I tried to wget or curl this image from the router but no success. It will download empty file. I download it to my computer and done

scp *.ubi root@192.168.31.145:/tmp

Firmware is now copied to router /tmp directory. In that directory check curremt system slot like described in firmware repo and just run ubiformat on another slot.
Also after flashing run nvram commands and reboot router.
And that was it. Openwrt is installed on AX3000 RA80 Chinese model.

The only thing I noticed so far is that I get empty 5Ghz wifi on scanning but maybe some additional config should be used.