Install OpenWRT on Xiaomi CR6608 Router

Xiaomi CR6608 is a Wi-Fi6 AX1800 Router with 4 Gigabit Ethernet Ports. The router was manufacured for local Chinese ISP: CR6606 (China Unicom), CR6608 (China Mobile), CR6609 (China Telecom).

OpenWRT support for this device was migrated into OpenWRT master on Feb 7, 2022. Special thanks to InfWang for his effort on the PR ramips: add support for Xiaomi Mi Router CR660x series

Specifications:

• SoC: MediaTek MT7621AT
• RAM: 256MB DDR3 (ESMT M15T2G16128A)
• Flash: 128MB NAND (ESMT F59L1G81MB)
• Ethernet: 1000Base-T x4 (MT7530 SoC)
• WLAN: 2×2 2.4GHz 574Mbps + 2×2 5GHz 1201Mbps (MT7905DAN + MT7975DN)
• LEDs: System (Blue, Yellow), Internet (Blue, Yellow)
• Buttons: Reset, WPS
• UART: through-hole on PCB ((VCC 3.3v)(RX)(GND)(TX) 115200, 8n1)
• Power: 12VDC, 1A

The way to install OpenWRT on the Xiaomi CR6608 is simple and doesn’t required hardware modification. However, you will need a router running OpenWRT to proceed. It is a long video, but there are only 2 main steps:

• Get SSH access to the router
• Write OpenWRT firmware with mtd

Get SSH access to Xiaomi CR6608

First thing, connect the PC to the OpenWRT router. After that, create the xqsystem.lua file in /usr/lib/lua/luci/controller/admin/ with the below lines. Alternatively, you can create this file on your PC and upload it to the router with WinSCP.

module("luci.controller.admin.xqsystem", package.seeall)

function index()
      local page   = node("api")
      page.target  = firstchild()
      page.title   = ("")
      page.order   = 100
      page.index = true
      page   = node("api","xqsystem")
      page.target  = firstchild()
      page.title   = ("")
      page.order   = 100
      page.index = true
      entry({"api", "xqsystem", "token"}, call("getToken"), (""), 103, 0x08)
end

local LuciHttp = require("luci.http")

function getToken()
      local result = {}
      result["code"] = 0
      result["token"] = "; nvram set ssh_en=1; nvram commit; sed -i 's/channel=.*/channel=\"debug\"/g' /etc/init.d/dropbear; /etc/init.d/dropbear start;"
      LuciHttp.write_json(result)
end

To verify, you can browse

http://{OpenWRT-Router-IP}/cgi-bin/luci/api/xqsystem/token

It should give you a respond like this:

{"code":0,"token":"; nvram set ssh_en=1; nvram commit; …"}

Now, setup the wireless interface on the OpenWRT router. To make it simple, I setup the SSID on 2.4GHz radio, SSID openwrt and the password is 12345678

After that, change the IP address of the LAN (br-lan) interface to 169.254.31.1 and turn off DHCP server for this interface. Please note that, if you are changing the IP address using LuCI, you will need to set a static IP adddress for the PC to 169.254.31.3 and vist the OpenWRT router at 169.254.31.1 to confirm the changes (else, the router will revert the IP to default after 1 – 2 minutes).

Now, switch to the Xiaomi CR6608 Router

Connect to it via WiFi or Ethernet cable. After login to the Web UI, pay attention to the STOK ID which can be found on the URL

 http://Xiaomi-CR6608-IP/cgi-bin/luci/;stok={STOK}/web/home#router

We are going to use the STOK for the next 2 query.

http://Xiaomi-CR6608-IP/cgi-bin/luci/;stok={STOK}/api/misystem/extendwifi_connect?ssid={WiFi-SSID}&password={WiFi-Password}

Now, run the second command to get SSH access

http://Xiaomi-CR6608-IP/cgi-bin/luci/;stok={STOK}/api/xqsystem/oneclick_get_remote_token?username=xxx&password=xxx&nonce=xxx

At this step, you should be able to connect SSH to the router. The username is root and the password is the default password at the back of the router. (默认登录密码)

Since UART access is locked ootb, you should get UART access by modify uboot env. Otherwise, your router may become bricked.
Excute these in stock firmware shell:

nvram set boot_wait=on
nvram set bootdelay=3
nvram commit

If you don’t want to install OpenWRT now, you can safely shutdown the router and the SSH connection will be avalable. However, if you can’t wait to install OpenWRT (I think this is the reason you are reading this post, please proceed)

Install OpenWRT on Xiaomi CR6608 with mtd

We are going to need the openwrt-ramips-mt7621-xiaomi_mi-router-cr660x-squashfs-firmware.bin for the installation. Click here to download the firmware for the Xiaomi CR660x series.

If the Xiaomi CR6608 is having internet connection, you can use wget or curl command to download the firmware directly to the /tmp directory. Or, you can download it to the computer and upload it to your router with WinSCP.

After that, run these commands

nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=1
nvram commit

Finnaly, executive this command to flash OpenWRT on the Xiaomi CR6608

mtd -r write /tmp/openwrt-squashfs-firmware.bin firmware

After this, the router will reboot itself and you can establish the SSH connection to it at 192.168.1.1. to install LuCI. Connect the WAN port of the CR6608 to the upstream router for internet connection and the below commands to install LuCI

opkg update
opkg install luci

Now, you should be able to reach LuCI at 192.168.1.1

Good luck and enjoy your CR660x OpenWRT router!