Adding OpenWrt support for Xiaomi AX3600 (Part 1)

I just spotted it for around 110$ without discounts or coupons applied. Not too bad considering some dude needs to buy, package and ship it to you and prob wants to make a few dollars as well for doing so.

Strongly considering this device as I need WiFi 6 router.

The Huawei is a lot cheaper though but seems less spec.

Yep I bought it for the official price of 599 RMB which is 85 USD or 78 EUR.

So my current plan is to use this router for WiFi network, and since OpenWRT is not supported at this time, I got an additional OrangePi R2S with dual gigabit Ethernet to plug in between the modem and the WiFi router. The OrangePi supports OpenWRT so I hope to be able to do all the configuration that I want.

This is neither the most energy efficient solution nor the one with least cabling, and might also not be the cheapest, but I hope to get maximum flexibility for a reasonable price (around 100$).

I bought it at this price. But you must make a panic purchase, or you must pay more at 3rd store

it looks like this exploit might work for this router

1 Like

seems not working New Xiaomi Router AC2100

this router is ARM based and the script was written for mips, pppd is likely to be exploitable in this router too but the script might need to be modified

It's not exploitable on the AX3600 to the extent of RCE. Or if it is, it's beyond my level.

You'll probably have to do some horrible nand reprogramming, and that's assuming the IPQ8071A does not possess some form of verified boot chain enabled.

I doubt that secure boot is enabled, last time I checked QCA U-boot fork did not have support for it at all.
Yeah, since there is no SPI-NOR onboard, its a pain since if U-boot UART is disabled then you are only left with the parallel NAND.

I would love to get one of these to start on IPQ807x support, but they are not available in Europe and there is no GPL

Do you think it'll be possible to use the separate IoT antenna of this router in a way the stock firmware does? As in using it to span a second wifi network for IoT devices?

Guess it would work if it's exposed as 2 additional radios for 2.4 and 5 GHz.

Yes, since "IOT" is just a QCA9889 as the third radio.

Are you sure it's just exposed as one radio? Asking because it's a dual band chip.

By radio I meant physical radio, if its configured for concurrent dual band then it will be exposed as 2 interfaces.

So.. Is there any possible way to get the ssh on this router now?

I'm just curious what functionality (services) you use from OpenWRT to have external 'router' (OrangePi)
instead of just use such powerful CPU in this Xiaomi?

Uhm it's mostly for some split-tunneling VPN service. The stock Xiaomi firmware does support VPN, but no extended functionality (such as changing server or using shadowsocks).

1 Like

got one on order!

here is the instruction set for this SOC: https://openwrt.org/docs/techref/instructionset/aarch64_cortex-a53

if it's helpful this is the marketing material for the SOC from Qualcomm: https://www.qualcomm.com/media/documents/files/qualcomm-networking-pro-600-platform-product-brief.pdf

And this leads us to question- If and when OpenWrt can support Qualcomm IPQ8071A?

That mostly depends on getting boards to work on as there is upstream support for a decent amount of the IPQ807x series including the wireless driver.

But, as long as boards cost 300+ EUR nobody is gonna be buying those.
And this Xiaomi board is unavailable anywhere else then China

Anywhere else then known chinese portals. True, it is more expensive, but you can get one for about 120$.