OpenWrt support for Xiaomi AX9000

psi-c · 2022-02-17T21:34:48.566Z

Right now I've pulled the flash from mine after a little accident, not got round to reprogramming the bodged part yet, but potentially I could try an older bootloader. I've got the same U-boot version as you and also the Secure boot fuse message on boot. Never got round to flashing an image, only tftpbooted it but I suspect it's identical. Ideally I'd test this on a spare chip though just to be extra safe...

Alternatively I don't suppose Robi you ever got round to checking out JTAG on this?

robimarko · 2022-02-17T21:46:39.591Z

No, I never looked for JTAG.
If its there then in theory you can enable the required clocks and load it back

namidairo · 2022-02-18T01:49:04.086Z

k1x0r:

There might be a chance of flashing an old uboot, which doesn't verify the the signature. And still has a valid signature,

Shouldn't be a huge problem assuming that the nand read and bootm commands are intact, as one can just modify the bootcmd as you have. Assuming they don't attempt to reset bootcmd somehow.

You would probably want to dump their u-boot anyway, just to compare the hashes with someone else's device to see if they actually did update it, but I suspect the secure boot fuse check is already in there as part of the original BSP source for their u-boot in the do_bootipq function. You could probably find it by searching for references to string "Cannot set fdt_high to %x to avoid relocation\n" if they haven't modified it too much.

Still, blowing the secure boot fuse. Yuck.

Edit: Also check their stock kernels for CONFIG_KEXEC. I would very much be amused to see a OpenWrt image that boots a stock image to kexecboot another.

k1x0r · 2022-02-18T11:40:15.058Z

I dumped the contents of my nand flash. Analyzing the first 250kb, it looks like a first stage of boot, which authenticates uboot (as they left debug logs like "boot_authenticator.c") and performs initialization. Looking for "Cannot set fdt_high to %x to avoid relocation\n" or "do_bootipq" didn't give any results.

Just in case I'm ready to provide whatever chunks of flash that might be useful, like X509 certificates which they use to verify the boot process.

rmandrad · 2022-02-19T18:57:32.342Z

yes tftpb works fine in any xiaomi

robimarko · 2022-02-19T19:21:56.373Z

You do realize that I get the full message if replied directly?

robimarko · 2022-02-19T20:56:08.456Z

I dont understand what is your issue?
Can you point me to what I did to trigger you?

I dont mean that in a bad way, I am seriously interested

stephenc87 · 2022-02-22T09:48:56.689Z

If you are stuck in a bad place it might help if you asked for help
Try the TFTP boot with the official firmware, if that doesn't work you could try robi's firmware
You can find this under releases here https://github.com/robimarko/openwrt/releases
You should review the TFTP instructions here https://openwrt.org/inbox/toh/xiaomi/xiaomi_ax3600#tftp_recovery the filename remains the same
This is a development forum, please don't follow any instructions that you don't understand

RobertP · 2022-02-22T18:47:45.366Z

Just wondering if this ath11k patch (https://www.spinics.net/lists/devicetree/msg477977.html) could help us with SoC Wifi and QCN9074 PCIe coexistence?

robimarko · 2022-02-22T19:17:37.956Z

It shouldn't, its just refactoring so that WCN6750 which is a weird card can be supported.

RobertP · 2022-02-23T19:36:13.751Z

Hi @robimarko
Another blind shot, so don't get angry
It looks like there are some recent changes to DT bindings and ath11k code for PCI devices to benefit from these changes - https://www.spinics.net/lists/linux-wireless/msg218303.html
Is it something worth trying or not really?

robimarko · 2022-02-23T19:45:16.096Z

It's already backported, only useful with multiple cards and when you want to manually set the memory range.

rmandrad · 2022-02-25T13:56:26.338Z

there is no official firmware ! instructions here are muddled in that some have the chinese and others have the international firmware! Robi has the chinese version ... anyone on the international firmware that was able to load robi's firmware?

loading Robi's firmware with TFTP I get "ERROR: new format image overwritten - must RESET the board to recover
resetting ...
"

it feels to me that the international version enforced the use of a key... which if correct we need to create a fit image that is signed with the appropriate key

rmandrad · 2022-02-25T14:12:08.469Z

the kernel is able to boot with xiaomi_ax9000-fit-uImage.itb but then can't find the rootfs

psi-c · 2022-02-25T15:02:35.072Z

The official firmware is that which is installed on the router when it arrives (and any subsequent Xiaomi provided updates).

Aa for your tftpboot error, I can't remember if that's the same error as I got, but I did run into an issue of the default address the tftp image is downloaded to is too low for anything over a few MB image, so when the image is unpacked it overwrites the tftp downloaded image.

The AX3600 has a load address 0x44000000 whereas I think the AX9000 (international version anyway) uses 0x42000000.

You can change this to 0x44000000 which worked for me with something like
dhcp 0x44000000 IP:imagename

i.e. give the address as the 2nd parameter to dhcp or tftpboot.

stephenc87 · 2022-02-25T15:17:32.503Z

Here is the official firmware http://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/ra70/miwifi_ra70_firmware_d96a4_1.0.108.bin
Load that on to your modem if you have the international firmware

Once you have done that try following the instructions for the dropbear exploit so you can load Robi's firmware, also where are you receiving the TFTP error?

We are not here to get Xiaomi keys, we are here to get an OpenWRT build running on the AX9000, the instructions are a little messy because it is a work in progress

rmandrad · 2022-02-25T15:28:18.850Z

thank you @pci-c that was very helpful

tftpb 0x43500000 worked ! (after a few tries through different address ranges)

rmandrad · 2022-02-25T15:29:33.073Z

good luck with that! i suggest you delete your posting as it going to get people in trouble as I haven't seen (or experienced) any evidence that it works loading the chinese version into an already loaded international version ... they have different formats it seems HDR2 (international) and chinese (I assume HDR1)

rmandrad · 2022-02-25T18:07:52.059Z

so ... next step is to ubiformat mtd21/2 however if the loadaddress is 0x43500000 should i change the its loaddr ?

List item

psi-c · 2022-02-25T20:28:02.230Z

From recent reports if you've an international AX9000 then secure boot is enabled and that prevents you booting an image from flash.

The tftp load address is irrelevant, that's purely used for storing the transferred image into RAM, the image is then uncompressed and booted. The issue is at 0x42000000 the uncompressed image starts to overwrite the compressed image you've downloaded. Once successfully uncompressed, the compressed image is no longer needed.