OpenWrt support for Xiaomi AX9000

flebourse · 2021-12-06T20:32:01.510Z

Yes, sorry. The PR is in the robimarko/nss-packages repo.

trourance · 2021-12-10T11:11:54.020Z

I've tried the exploit #179 on my AX9000 with FW 3.0.33, but as soon as I try to upload 1.bin, I always get the following popup: "Couldn't update. An error occured or router storage is full". Do you have any idea what might go wrong or is there any chance to find the root cause in the log files ?

flebourse · 2021-12-10T11:56:30.751Z

Yes try exploit #251 instead, this one is for FW 3.0.33.

trourance · 2021-12-10T12:49:50.247Z

I've tried that one too, with create_exploit_hdr2.js but I get the same error message.
Btw, is it possible that a manual update is blocked because there's an official update (3.0.40) pending ?

flebourse · 2021-12-10T16:20:47.494Z

Could you try to do a reset to factory defaults before applying the exploit ?

trourance · 2021-12-10T22:10:54.985Z

Ok, I tried and it's a nightmare. The first 1.bin uploaded successfully, but on 2.bin I had the same error message. I did another factory reset and now I'm stucked on the init page and when I click "Try it now", I get a 500 internal error. No way to go ahead and use the router anymore. I was able to login with ssh but it's not a great help at the moment. Any idea how to unlock my router ?

flebourse · 2021-12-10T22:25:54.840Z

If you are able to login with ssh the exploit has more or less worked. Do you have a serial acces ? If so you should be able to break in the boot phase and tftpboot an OpenWrt image.

trourance · 2021-12-10T23:32:14.427Z

Yes, it has somehow worked. I was able to call an init URL that allowed me to restore my settings and the router is working again. The only thing that does now show anymore is the number of connected devices on the status page, but that's a detail.
I'll get a serial access in order to try an OpenWrt image.
Thanks for the support.

Loko · 2021-12-13T05:34:01.828Z

hello team,
i have 2 questions,

any of you know how to change the VLAN tagging for ax9000? i need to change to 500
i bought the CN unit, is that possible to flash to Global firmware? im hoping global firmware have ability to change the vlan

thanks in advance!

RobertP · 2021-12-17T18:05:37.692Z

Hi Loko,
I think this might not be the best forum to ask these questions - try Xiaomi forum instead, as both of your questions seems to be relevant to Xiaomi's firmware. I understand your confusion as Xiaomi advertises their firmware for this device as "OpenWRT based", but they simply used an older version of OpenWRT, customised it, added a bunch of their closed source code, etc...

Syiddiq · 2021-12-20T19:28:39.822Z

Found this during browsing. Hope it helps. Thanks everyone for your hardworks. God bless..

知乎专栏

小米AX9000 安装OpenWrt双系统

2021年11月更, ax9000官方推出了开发版固件,支持docker了,所以我准备发一篇安装docker的教程,但是docker并没有root和ssh权限.如果你是非要使用root和ssh那么请继续看本教程. 徐某某：小米AX9000 安装Docker及Docke…

dchard · 2021-12-20T20:04:27.428Z

No, it does not help, has nothing to do with Openwrt.

rmandrad · 2021-12-21T15:29:56.754Z

Hi everyone

contemplating buying one of this ... however it seems from reading on this forum it is still in early development the openwrt version.

A quick question - are you finding the drivers are not open source ? I have a wrt3200acm and as you probably suspect don't want to end up with a driver like mwlwifi but with something that is top end, affordable and open source.

thank you & hope you enjoy the season with your loved ones

AlexMclellan · 2021-12-21T21:28:57.900Z

Well, I've just tried this with robimarko's latest built images.

root@XiaoQiang:~# nvram set ssh_en=1; nvram set uart_en=1; nvram set boot_wait=on; nvram commit;
root@XiaoQiang:~# reboot
...
root@XiaoQiang:~# ubiformat /dev/mtd22 -y -f /tmp/openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-nand-factory.ubi
ubiformat: mtd22 (nand), size 58720256 bytes (56.0 MiB), 448 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 447 -- 100 % complete  
ubiformat: 301 eraseblocks have valid erase counter, mean value is 0
ubiformat: 147 eraseblocks are supposedly empty
ubiformat: warning!: only 301 of 448 eraseblocks have valid erase counter
ubiformat: mean erase counter 0 will be used for the rest of eraseblock
ubiformat: use erase counter 0 for all eraseblocks
ubiformat: flashing eraseblock 92 -- 100 % complete  
ubiformat: formatting eraseblock 447 -- 100 % complete  
root@XiaoQiang:~# nvram get flag_last_success
0
root@XiaoQiang:~# nvram set flag_last_success=1
root@XiaoQiang:~# nvram set flag_boot_rootfs=1
root@XiaoQiang:~# nvram commit
root@XiaoQiang:~# reboot
root@XiaoQiang:~# Connection to 192.168.31.1 closed by remote host.
Connection to 192.168.31.1 closed.

Doesn't appear to come back up, and no wifi point is visible. However plugging the wan ethernet port into my computer, which acts as a DHCP server, an IP address comes up for the device, but I'm not able to ssh into it and nmap suggests all ports are closed. So I guess something's partially booted up.

I guess I'll try the recovery process, or get a debug cable that won't brick the device. Maybe this is flebourse's issue.

AlexMclellan · 2021-12-21T23:08:57.402Z

Ah, looks like I managed to recover it, using the recovery tool (Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit) -- fully supported and flashable with OpenWRTInvasion - #747 by Zorro). Would be great to know if I did something wrong.

kirdes · 2021-12-22T07:19:49.822Z

You need to flash both rootfs partitions.

mtd21: 03800000 00020000 "rootfs"
mtd22: 03800000 00020000 "rootfs_1"

flebourse · 2021-12-23T15:43:42.396Z

Doesn't seem to be the same issue, if your PC is able to receive a correct dhcp request the uplink is working at least in the router->PC direction.
By default the firewall on the router block almost everything on the wan link, one solution would be to generate a firmware containing a permissive firewall configuration.

AlexMclellan · 2021-12-23T15:46:30.364Z

Yes. I think I hadn't realised how locked down the openwrt firmware would be after first installation. It's all working now.

Thanks for your, and kirdes, help.

RobertP · 2021-12-27T10:42:42.872Z

My new & shiny AX9000 has just arrived

Is there a way to get ssh access without serial nor secondary OpenWRT router? (my current OpenWRT router has HTTPs enabled)
Is QCN PCIe working?
Is robi's image using an overlay partitions or still uses two rootfs only?

Thanks!

trourance · 2021-12-28T12:56:58.919Z

I would like to compile the firmware for my AX9000, but I haven't found any information about which branch to use on robimarko,s repo. Should I use IPQ807x-5.10-backports or ipq807x-5.15 ?