Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
| inbox:toh:xiaomi:xiaomi_redmi_ax6_ax3000 [2020/12/29 22:25] – [Info] dchard | inbox:toh:xiaomi:xiaomi_redmi_ax6_ax3000 [2024/08/07 00:41] – [Potential issues / Limitations] jiejianshiwaxinge | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Xiaomi Redmi AX6 AX3000 | + | ====== Xiaomi Redmi AX6 Wi-Fi 6 Mesh Router====== |
| - | ~~NOTOC~~ | + | |
| /* This template is intended to be used via https:// | /* This template is intended to be used via https:// | ||
| - | {{page> | + | /* {{page> |
| - | //Write a short, relevant description of the device. Include a technical overview, but avoid marketing buzzwords/ | ||
| /*****/ | /*****/ | ||
| Line 12: | Line 9: | ||
| /*****/ | /*****/ | ||
| - | {{ media: | + | Xiaomi Redmi AX6 is a Wi-fi 6 (802.11ax) capable mesh router, with 4+2 core ARM CPU, 512MB RAM, 128MB flash and 1+3 gigabit capable ethernet ports. |
| - | ===== OpenWrt support ===== | ||
| - | <color red> | + | {{ media: |
| + | The Xiaomi Redmi AX6 Router is an 802.11ax OFDMA and MU-MIMO Dual-Band WiFi router, which has the following WiFi Interfaces.: | ||
| + | * one 2.4GHz (QCN5024 2x2/40MHz ax) | ||
| + | * one 5GHz (QCN5054 4x4/80 or 2x2/160MHz ax) | ||
| - | ===== Supporting activities ===== | + | The radios support up to 4K QAM (through MCS0 - MCS15), for devices and paths that are compatible with those high-density modulations. Supports DFS channels, from channel 36 up to 165 (may vary on each region). |
| - | //Describe if there are any ongoing activities | + | |
| - | * OpenWrt forum thread: [[https://forum.openwrt.org/ | + | This is a router based on a Qualcomm IPQ8071A |
| + | It has three 1G LAN ports, one 1G WAN port and 6 non-detachable external antennas. | ||
| + | | ||
| - | /*** if info available: uncomment and fill in | ||
| - | ===== Experimental firmware ===== | ||
| - | //List experimental firmware download links here.// | + | ===== OpenWrt support ===== |
| - | //None at this time.// | + | Supported since [[commit> |
| + | <!-- ToH: { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } --> | ||
| + | |||
| + | ==== Potential issues | ||
| + | * The '' | ||
| + | * Ath11k memory: The ath11k driver needed for the main wireless radios uses a lot of memory when there are few stations connected and low bandwidth traffic flowing.After testing, | ||
| + | * NSS acceleration: | ||
| + | * The IPQ807x target has not yet support for [[: | ||
| + | |||
| + | ===== Supporting activities ===== | ||
| + | |||
| + | * OpenWrt forum thread: [[https:// | ||
| + | * China Openwrt installation [[https:// | ||
| + | * Experimental community OpenWrt with NSS acceleration support [[https:// | ||
| - | * External image (add link) | ||
| - | * trunk image (add link) | ||
| - | * ... | ||
| - | ***/ | ||
| ===== Hardware highlights ===== | ===== Hardware highlights ===== | ||
| - | ^ CPU ^ Ram ^ Flash ^ Network | + | <!-- ToH: { |
| - | | Qualcomm IPQ8071A 4core A53 1.4GHz | + | |
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } --> | ||
| + | ==== More Info ==== | ||
| + | |||
| + | <!-- ToH: { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } --> | ||
| + | |||
| + | === Notes === | ||
| + | * Flash chips known is ESMT F59D1G81MB-AZM1P9ACX. Maybe there are more variations of Flash Chips soldered on it. Needs more investigation. | ||
| + | * Stock partitioning assumes ~35M size for each of `rootfs` MTD partitions, and ~30M for `overlay` MTD partition (and even with that, mounted `/overlay` partition somewhy only have size of 15M) | ||
| - | /*** if info available: uncomment and fill in | ||
| ===== Installation ===== | ===== Installation ===== | ||
| + | |||
| + | /*** | ||
| - → [[: | - → [[: | ||
| - → [[docs: | - → [[docs: | ||
| - → [[: | - → [[: | ||
| + | ***/ | ||
| + | |||
| + | ==== Firmware download ==== | ||
| + | /* snapshot table */ | ||
| + | <!-- ToH: { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } --> | ||
| + | |||
| + | <WRAP round info> | ||
| + | Snapshot versions don't have '' | ||
| + | </ | ||
| ==== Installing OpenWrt ==== | ==== Installing OpenWrt ==== | ||
| - | ***/ | + | |
| + | To flash this image there is a need for SSH access to the OEM firmware. It is not possible for now to flash OpenWrt from the stock FW with the OpenWrt Factory image. | ||
| + | To gain SSH access, you will need a second router (any device) with OpenWrt firmware (further refered to as Router B). | ||
| + | |||
| + | === SSH Access === | ||
| + | |||
| + | - Roll back to firmware to 1.0.16 || [[ https:// | ||
| + | - Setup the router admin password (quick way is using the mobile setup app) | ||
| + | - On Router B: | ||
| + | | ||
| + | * (Your PC may disconnect from the router. In that case, set manual IP on the PC to e.g. " | ||
| + | * Create wifi with SSID " | ||
| + | * SSH or SCP in and create a file **/ | ||
| + | * Copy following to the file: < | ||
| + | module(" | ||
| + | |||
| + | function index() | ||
| + | local page = node(" | ||
| + | page.target | ||
| + | page.title | ||
| + | page.order | ||
| + | page.index = true | ||
| + | page = node(" | ||
| + | page.target | ||
| + | page.title | ||
| + | page.order | ||
| + | page.index = true | ||
| + | entry({" | ||
| + | end | ||
| + | |||
| + | local LuciHttp = require(" | ||
| + | |||
| + | function getToken() | ||
| + | local result = {} | ||
| + | result[" | ||
| + | result[" | ||
| + | LuciHttp.write_json(result) | ||
| + | end | ||
| + | </ | ||
| + | |||
| + | * Copy following to a web browser: < | ||
| + | 4. Connect back to Redmi AX6 and proceed: | ||
| + | * Open the web interface and log in on < | ||
| + | * Retreive the STOK value from the web address. E.g. for following < | ||
| + | * Copy the following line to the web browser and replace "< | ||
| + | * After some time, the page should return < | ||
| + | * Copy the following line to the web browser and replace "< | ||
| + | 5. Now you have a working SSH access to AX6: | ||
| + | * Login using SSH: < | ||
| + | * Enter the following lines one by one to the SSH terminal: < | ||
| + | nvram set boot_wait=on | ||
| + | nvram set telnet_en=1 | ||
| + | nvram set ssh_en=1 | ||
| + | nvram commit</ | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | === Flashing OpenWrt === | ||
| + | |||
| + | After getting SSH access, you will now be able to flash a previously compiled image (by you since for the time being there are no official automated images): | ||
| + | |||
| + | - Copy the OpenWrt generated image (the '' | ||
| + | - This is a device with a dual partition scheme layout, so you need to find out which one is running with the command < | ||
| + | - The output should be the partition number where the current system was booted from < | ||
| + | mtd13: 023c0000 00020000 " | ||
| + | - Since you can't flash the current partition because it's locked you can only flash the opposite one by replacing the '' | ||
| + | ubiformat /dev/mtd12 -f / | ||
| + | </ | ||
| + | - After flashing the image you need to configure the u-boot to boot from the recently flashed image by replacing the '' | ||
| + | nvram set flag_last_success=0 # if you've flashed mtd12, or " | ||
| + | nvram set flag_boot_rootfs=0 # same | ||
| + | </ | ||
| + | nvram set flag_ota_reboot=1 | ||
| + | </ | ||
| + | - save the changes and reboot< | ||
| + | nvram commit | ||
| + | reboot | ||
| + | </ | ||
| + | - Previous commands flashed an ubinized OpenWrt initramfs that will serve as the intermediate step since OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for packages. Continue with the next steps in order to permanently flash OpenWrt. | ||
| + | - SSH into OpenWrt from one of the LAN ports | ||
| + | - Copy the file '' | ||
| + | - Sysupgrade the device:< | ||
| + | |||
| + | Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired. Although, see [[# | ||
| + | |||
| + | |||
| + | <WRAP info> | ||
| + | In openwrt the commands to check and change the boot partition are different: | ||
| + | |||
| + | < | ||
| + | fw_printenv flag_boot_rootfs | ||
| + | fw_setenv flag_boot_rootfs 0 # if you've flashed mtd12 or " | ||
| + | fw_setenv flag_last_success 0 # same | ||
| + | </ | ||
| + | </WRAP> | ||
| - | /*** if info available: uncomment and fill in | ||
| ===== Debricking ===== | ===== Debricking ===== | ||
| -> [[docs: | -> [[docs: | ||
| - | ***/ | + | |
| + | ==== TFTP recovery ==== | ||
| + | Redmi AX6 can be recovered from a soft-brick with TFTP. The flow is: | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | Because of this quirk we will have to configure the tftp server to assign only one IP and we will set the file name to the only IP address it can receive. | ||
| + | |||
| + | For Windows you can use [[https:// | ||
| + | These are the steps to do it for Linux (this can be adapted to the tftpd64' | ||
| + | |||
| + | * Create a folder somewhere to place your firmware for the tftp server and download the OEM firmware (the file name is a very important part; if you have previously had installed Xiaomi firmware version 1.1.14, you might need to adjust the name of the .img file to a different one. The router will be looking for a specific file name on the tftp – if it does not match the one you have in the tmp folder, rename it accordingly and proceed again):< | ||
| + | wget https:// | ||
| + | * To ensure that the TFTP server has access to the firmware, set the privileges:< | ||
| + | sudo chown -R nobody: | ||
| + | |||
| + | * Obtain the name of the ethernet adapter (to be used in further steps):< | ||
| + | * The result will loke something like (in this case, the name of the ethernet adapter is enp2s0):< | ||
| + | link/ | ||
| + | 2: enp2s0: < | ||
| + | link/ether xx: | ||
| + | 3: wlp3s0: < | ||
| + | link/ether yy: | ||
| + | * Set a static address on your PC to serve the firmware from: < | ||
| + | sudo ip address add 192.168.31.100/ | ||
| + | * Run the server with the following command:< | ||
| + | * Unplug the power, press and hold the reset button, plug the power back while still holding the button.< | ||
| + | * Hold the reset button until the router' | ||
| + | * then it goes solid orange again, release the button. | ||
| + | * If in the terminal, you see that the router requests a different firmware file (different name; if you have previously had a Xiaomi firmware v.1.1.14 on the router), rename the file in the tmp folder and repeat the procedures from the IP flush again. | ||
| + | </ | ||
| + | * When the device finished loading the firmware, the led starts flashing with orange (amber) light. Wait for until blue led to goes solid! <WRAP info> | ||
| + | * It might take some time for the led to go solid blue | ||
| + | * If the recovery doesn' | ||
| + | * If the led is blinking blue led it means the device was flashed successfully and can be restarted | ||
| + | </ | ||
| + | * Put your interface back to DHCP mode and start again with breaking your device | ||
| Line 87: | Line 272: | ||
| | vlan1 (eth0.1) | | vlan1 (eth0.1) | ||
| | wl0 | EXAMPLE WiFi | EXAMPLE Disabled | | wl0 | EXAMPLE WiFi | EXAMPLE Disabled | ||
| - | </ | + | </ |
| ***/ | ***/ | ||
| Line 114: | Line 299: | ||
| ^ Vendor | ^ Vendor | ||
| ^ Bootloader | ^ Bootloader | ||
| - | ^ System-On-Chip | + | ^ System-On-Chip |
| - | ^ CPU/ | + | ^ CPU/ |
| ^ Flash-Chip | ^ Flash-Chip | ||
| ^ Flash size | 128 MB | | ^ Flash size | 128 MB | | ||
| ^ RAM | 512MB DDR3 (EM6HE16EWAKG-10H) | ^ RAM | 512MB DDR3 (EM6HE16EWAKG-10H) | ||
| - | ^ Wireless | + | ^ Wireless |
| - | ^ Ethernet | + | ^ Wireless features| RX LDPC, TX STBC, SUBF, MUBF (2.4GHz |
| - | ^ Switch | + | ^ Wireless features| 5GHz FEM: QPF4550 (+20.5dBm MCS9VHT80); 2.4GHz FEM: QPF4200 (+21dBm MCS9VHT40; +22.5dBm MCS7VHT40 ) | |
| + | ^ Ethernet | ||
| + | ^ Switch | ||
| ^ USB | No | | ^ USB | No | | ||
| ^ Serial | ^ Serial | ||
| ^ JTAG | Not populated | ^ JTAG | Not populated | ||
| - | |||
| /*** if info available: uncomment and fill in | /*** if info available: uncomment and fill in | ||
| Line 138: | Line 324: | ||
| ==== Photos ==== | ==== Photos ==== | ||
| + | {{media: | ||
| - | **Xiaomi | + | **Redmi AX6 front PCB** |
| - | {{:media: | + | {{media:xiaomi: |
| - | **Xiaomi | + | **Redmi AX6 back PCB** |
| + | |||
| + | {{media: | ||
| + | |||
| + | **Redmi AX6 RF frontend comparison** | ||
| + | |||
| + | {{: | ||
| - | {{: | ||
| ==== Opening the case ==== | ==== Opening the case ==== | ||
| To open the case, first remove the sticker from the bottom of the device. Two phillips screws are holding it together. After removing the screws, there are still plastic claws around the top piece and the edge. Gently use a guitar pick or similar tool to start separating the top piece around the edge. | To open the case, first remove the sticker from the bottom of the device. Two phillips screws are holding it together. After removing the screws, there are still plastic claws around the top piece and the edge. Gently use a guitar pick or similar tool to start separating the top piece around the edge. | ||
| + | |||
| + | {{: | ||
| ==== Serial port ==== | ==== Serial port ==== | ||
| Serial port pinout is clearly marked on the board. | Serial port pinout is clearly marked on the board. | ||
| + | |||
| + | Note: It's been reported the device uses **1.8V**. | ||
| TTL serial connection is possible, the header has to be soldered, no missing components (resistors etc). There is 5 seconds to enter the bootloader (press ENTER). | TTL serial connection is possible, the header has to be soldered, no missing components (resistors etc). There is 5 seconds to enter the bootloader (press ENTER). | ||
| - | ^ Serial connection parameters for Xiaomi Redmi AX6 AX3000 | + | ^ Serial connection parameters for Xiaomi Redmi AX6 | TTL, 115200, 8N1 | |
| ==== JTAG ==== | ==== JTAG ==== | ||
| - | -> [[docs: | ||
| No JTAG interface | No JTAG interface | ||
| Line 1302: | Line 1497: | ||
| </ | </ | ||
| + | ==== MTD layout ==== | ||
| + | < | ||
| + | root@XiaoQiang:/# | ||
| + | |||
| + | ROM ver: config core ' | ||
| + | # ROM ver | ||
| + | option ROM ' | ||
| + | # channel | ||
| + | option CHANNEL ' | ||
| + | # hardware platform R1AC or R1N etc. | ||
| + | option HARDWARE ' | ||
| + | # CFE ver | ||
| + | option UBOOT ' | ||
| + | # Linux Kernel ver | ||
| + | option LINUX ' | ||
| + | # RAMFS ver | ||
| + | option RAMFS ' | ||
| + | # SQUASHFS ver | ||
| + | option SQAFS ' | ||
| + | # ROOTFS ver | ||
| + | option ROOTFS ' | ||
| + | #build time | ||
| + | option BUILDTIME 'Wed, 19 Aug 2020 02:57:56 +0000' | ||
| + | #build timestamp | ||
| + | option BUILDTS ' | ||
| + | #build git tag | ||
| + | | ||
| + | Hardware | ||
| + | ROM sum: | ||
| + | System | ||
| + | KERNEL | ||
| - | ---- | + | MTD table: |
| + | dev: size | ||
| + | mtd0: 00100000 00020000 " | ||
| + | mtd1: 00100000 00020000 " | ||
| + | mtd2: 00300000 00020000 " | ||
| + | mtd3: 00080000 00020000 " | ||
| + | mtd4: 00080000 00020000 " | ||
| + | mtd5: 00080000 00020000 " | ||
| + | mtd6: 00080000 00020000 " | ||
| + | mtd7: 00100000 00020000 " | ||
| + | mtd8: 00080000 00020000 " | ||
| + | mtd9: 00080000 00020000 " | ||
| + | mtd10: 00080000 00020000 " | ||
| + | mtd11: 00080000 00020000 " | ||
| + | mtd12: 023c0000 00020000 " | ||
| + | mtd13: 023c0000 00020000 " | ||
| + | mtd14: 01ec0000 00020000 " | ||
| + | mtd15: 00080000 00020000 " | ||
| + | mtd16: 0041e000 0001f000 " | ||
| + | mtd17: 016c4000 0001f000 " | ||
| + | mtd18: 01ae2000 0001f000 " | ||
| + | IPQ807x# smeminfo | ||
| + | flash_type: | ||
| + | flash_index: | ||
| + | flash_chip_select: | ||
| + | flash_block_size: | ||
| + | flash_density: | ||
| + | partition table offset | ||
| + | No.: Name | ||
| + | 0: 0: | ||
| + | 1: 0: | ||
| + | 2: 0: | ||
| + | 3: 0: | ||
| + | 4: 0:RPM 0x0000ffff | ||
| + | 5: 0:CDT 0x0000ffff | ||
| + | 6: 0: | ||
| + | 7: 0: | ||
| + | 8: 0:ART 0x0000ffff | ||
| + | 9: bdata 0x0000ffff | ||
| + | 10: crash 0x0000ffff | ||
| + | 11: crash_syslog | ||
| + | 12: rootfs | ||
| + | 13: rootfs_1 | ||
| + | 14: overlay | ||
| + | 15: rsvd0 0x0000ffff | ||
| + | </ | ||
| - | __**How to enable Serial, SSH, Telnet:**__ | + | ==== / |
| + | < | ||
| + | root@XiaoQiang:/# | ||
| + | | ||
| + | 3: | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | 100: 62537 0 0 0 GIC 425 Edge nss_queue0 | ||
| + | 101: 0 0 0 0 GIC 426 Edge nss_queue1 | ||
| + | 102: 0 0 0 0 GIC 427 Edge nss_queue2 | ||
| + | 103: 0 0 0 0 GIC 428 Edge nss_queue3 | ||
| + | 104: 0 0 0 0 GIC 429 Edge nss_coredump_complete | ||
| + | 105: 0 0 0 0 GIC 430 Edge nss_paged_empty_buf_sos | ||
| + | 106: 0 0 0 0 | ||
| + | 107: | ||
| + | 108: 0 0 0 0 GIC 239 Level | ||
| + | 109: 62541 0 0 0 GIC 178 Level | ||
| + | 132: 4 0 0 0 GIC 348 Edge ce0 | ||
| + | 133: | ||
| + | 134: | ||
| + | 135: | ||
| + | 137: | ||
| + | 139: | ||
| + | 140: | ||
| + | 141: 0 0 0 0 GIC 334 Edge ce9 | ||
| + | 142: 0 0 0 0 GIC 333 Edge ce10 | ||
| + | 143: 0 0 0 0 | ||
| + | 147: 2 0 0 0 GIC 326 Edge host2rxdma-monitor-ring3 | ||
| + | 148: 0 0 0 0 GIC 325 Edge host2rxdma-monitor-ring2 | ||
| + | 149: 2 0 0 0 GIC 324 Edge host2rxdma-monitor-ring1 | ||
| + | 150: 0 0 0 0 GIC 323 Edge reo2ost-exception | ||
| + | 151: 0 0 0 0 GIC 322 Edge wbm2host-rx-release | ||
| + | 152: 0 0 0 0 GIC 321 Edge reo2host-status | ||
| + | 153: 0 0 0 0 GIC 320 Edge reo2host-destination-ring4 | ||
| + | 154: 0 0 0 0 GIC 271 Edge reo2host-destination-ring3 | ||
| + | 160: 1 7 0 0 GIC 263 Edge ppdu-end-interrupts-mac3 | ||
| + | 161: 0 0 0 0 GIC 262 Edge ppdu-end-interrupts-mac2 | ||
| + | 162: 1 0 0 0 GIC 261 Edge ppdu-end-interrupts-mac1 | ||
| + | 163: 3 0 0 0 GIC 260 Edge rxdma2host-monitor-status-ring-mac3 | ||
| + | 164: 0 0 0 0 GIC 256 Edge rxdma2host-monitor-status-ring-mac2 | ||
| + | 165: 3 0 0 0 GIC 255 Edge rxdma2host-monitor-status-ring-mac1 | ||
| + | 167: 0 0 0 0 GIC 215 Edge host2rxdma-host-buf-ring-mac2 | ||
| + | 169: 0 0 0 0 GIC 211 Edge rxdma2host-destination-ring-mac3 | ||
| + | 170: 0 0 0 0 GIC 210 Edge rxdma2host-destination-ring-mac2 | ||
| + | 171: 0 0 0 0 GIC 209 Edge rxdma2host-destination-ring-mac1 | ||
| + | 176: 0 0 0 0 GIC 191 Edge wbm2host-tx-completions-ring3 | ||
| + | 182: 0 0 0 0 GIC 216 Edge tsens_interrupt | ||
| + | 183: 5 0 0 0 | ||
| + | 185: 3 0 0 0 pmic_arb 3211277 Edge spmi-vadc | ||
| + | 186: 0 0 0 1 | ||
| + | 187: 0 0 0 0 | ||
| + | 188: 0 0 0 0 | ||
| + | 189: 0 0 0 0 GIC 172 Edge xhci-hcd: | ||
| + | IPI0: 3803 | ||
| + | IPI1: | ||
| + | IPI2: | ||
| + | IPI3: | ||
| + | IPI4: | ||
| + | IPI5: | ||
| + | Err: 0 | ||
| + | </ | ||
| + | ===== How to enable Serial, SSH, Telnet | ||
| Issue the following commands in bootloader: | Issue the following commands in bootloader: | ||
| - | * setenv uart_en 1 | + | < |
| - | | + | setenv uart_en 1 |
| - | | + | setenv telnet_en 1 |
| - | | + | setenv ssh_en 1 |
| + | saveenv | ||
| + | reset | ||
| + | </ | ||
| + | To enable SSH, after the above steps you will need to set a password using the following command: | ||
| + | < | ||
| + | passwd root | ||
| + | </ | ||
| + | then edit / | ||
| + | < | ||
| + | vi / | ||
| + | </ | ||
| + | look for the following section | ||
| + | < | ||
| + | and modify it to this: | ||
| + | < | ||
| + | save the file and reboot the router. | ||
| ===== Notes ===== | ===== Notes ===== | ||
| ===== Tags ===== | ===== Tags ===== | ||
| [[meta: | [[meta: | ||
| - | {{tag>EXAMPLETAG unsupported}} | + | {{tag>ipq807x IPQ8071 128NAND 512RAM 4port GigabitEthernet 802.11ax wifi6 CortexA53 QCN5054 QCN5024 4x4 mu-mimo VHT160 4core LDPC QPF4550 QPF4200 TXBF txpa serial U-Boot ARMv8}} |