OpenWrt support for Xiaomi AX9000

For Developers
772

a Chinese developer made a QSDK firmware can use the 160mhz,
and i found a script in /etc/init.d named wifi_fw_mount
would you want to try if it works?

#!/bin/sh /etc/rc.common
#
# Copyright (c) 2017-2019 The Linux Foundation. All rights reserved.
# Permission to use, copy, modify, and/or distribute this software for any
# purpose with or without fee is hereby granted, provided that the above
# copyright notice and this permission notice appear in all copies.
#
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

START=00
STOP=95

create_soft_link()
{
        if [ -e /sys/firmware/devicetree/base/AUTO_MOUNT ]; then
                cp -f $*
        elif [ ! -e /sys/firmware/devicetree/base/AUTO_MOUNT ]; then
                ln -s $*
        fi
}

mount_wifi_fw (){
        local arch=""
        local hw=""
        local board_name
        local fwfolder="/lib/firmware"

        [ -f /tmp/sysinfo/board_name ] && {
                board_name=ap$(cat /tmp/sysinfo/board_name | awk -F 'ap' '{print$2}')
        }

        [ -e /sys/firmware/devicetree/base/AUTO_MOUNT ] && {
                case $board_name in
                        ap-mp*)
                                fwfolder="/lib/firmware/wifi"
                                mkdir -p $fwfolder
                        ;;
                esac
        }

        arch=$1
        case "$arch" in
                "IPQ8074")
                        hw="hw2.0"
        ;;
                "IPQ6018")
                        hw="hw1.0"
        ;;
                *)
                        hw="hw1.0"
        ;;
        esac

        if [ -d /lib/firmware/$arch/WIFI_FW/qcn9000 ]; then
                cd  $fwfolder && mkdir -p qcn9000 && mkdir -p /vendor/firmware/qcn9000
                cd qcn9000 && ln -s /lib/firmware/$arch/WIFI_FW/qcn9000/*.* .
                cd /vendor/firmware/qcn9000 && ln -s /lib/firmware/$arch/WIFI_FW/qcn9000/Data.msc .
                mkdir -p /lib/firmware/qcn9000 && cd /lib/firmware/qcn9000 && create_soft_link /lib/firmware/$arch/WIFI_FW/qcn9000/qdss* .
        fi

        if [ -d /lib/firmware/$arch/WIFI_FW/qcn9100 ]; then
                cd $fwfolder && mkdir -p qcn9100 && mkdir -p /vendor/firmware/qcn9100
                cd qcn9100 && ln -s /lib/firmware/$arch/WIFI_FW/qcn9100/*.* . && ln -s /lib/firmware/$arch/WIFI_FW/q6_fw.* .
                cd /vendor/firmware/qcn9100 && ln -s /lib/firmware/$arch/WIFI_FW/qcn9100/Data.msc .
                mkdir -p /lib/firmware/qcn9100 && cd /lib/firmware/qcn9100 && create_soft_link /lib/firmware/$arch/WIFI_FW/qcn9100/qdss* .
        fi

        if [ -d /lib/firmware/$arch/WIFI_FW/qcn6122 ]; then
                cd $fwfolder && mkdir -p qcn6122 && mkdir -p /vendor/firmware/qcn6122
                cd qcn6122 && ln -s /lib/firmware/$arch/WIFI_FW/qcn6122/*.* . && ln -s /lib/firmware/$arch/WIFI_FW/q6_fw.* .
                cd /vendor/firmware/qcn6122 && ln -s /lib/firmware/$arch/WIFI_FW/qcn6122/Data.msc .
                mkdir -p /lib/firmware/qcn6122 && cd /lib/firmware/qcn6122 && create_soft_link /lib/firmware/$arch/WIFI_FW/qcn6122/qdss* .
        elif [ -d /lib/firmware/$arch/WIFI_FW/qcn9100 ]; then
                cd $fwfolder && mkdir -p qcn6122 && mkdir -p /vendor/firmware/qcn6122
                cd qcn6122 && ln -s /lib/firmware/$arch/WIFI_FW/qcn9100/*.* . && ln -s /lib/firmware/$arch/WIFI_FW/q6_fw.* .
                cd /vendor/firmware/qcn6122 && ln -s /lib/firmware/$arch/WIFI_FW/qcn9100/Data.msc .
                mkdir -p /lib/firmware/qcn6122 && cd /lib/firmware/qcn6122 && create_soft_link /lib/firmware/$arch/WIFI_FW/qcn9100/qdss* .
        fi

        mkdir -p $fwfolder/$arch
        cd  $fwfolder/$arch && ln -s /lib/firmware/$arch/WIFI_FW/*.* .
        cd  /lib/firmware/$arch && create_soft_link /lib/firmware/$arch/WIFI_FW/qdss* .

        if [ -e /sys/firmware/devicetree/base/MP_512 ] || [ -e /sys/firmware/devicetree/base/MP_256 ]; then
                if [ -f /lib/firmware/$arch/WIFI_FW/firmware_rdp_feature_512P.ini ]; then
                        cd /lib/firmware
                        create_soft_link /lib/firmware/$arch/WIFI_FW/firmware_rdp_feature_512P.ini .
                elif [ -f /lib/firmware/$arch/WIFI_FW/qcn9000/firmware_rdp_feature_512P.ini ]; then
                        cd /lib/firmware
                        create_soft_link /lib/firmware/$arch/WIFI_FW/qcn9000/firmware_rdp_feature_512P.ini .
                fi
        else
                if [ -f /lib/firmware/$arch/WIFI_FW/firmware_rdp_feature.ini ]; then
                        cd /lib/firmware
                        create_soft_link /lib/firmware/$arch/WIFI_FW/firmware_rdp_feature.ini .
                elif [ -f /lib/firmware/$arch/WIFI_FW/qcn9000/firmware_rdp_feature.ini ]; then
                        cd /lib/firmware
                        create_soft_link /lib/firmware/$arch/WIFI_FW/qcn9000/firmware_rdp_feature.ini .
                fi
        fi

        . /lib/read_caldata_to_fs.sh
        do_load_ipq4019_board_bin

        if [ -e /lib/firmware/$arch/WIFI_FW/board-2.bin ]; then
                mkdir -p /lib/firmware/ath11k/$arch/$hw
                cd /lib/firmware/ath11k/$arch/$hw/
                ln -s /lib/firmware/$arch/WIFI_FW/board-2.bin .
                ln -s /tmp/$arch/caldata.bin .
                ln -s /lib/firmware/$arch/qdss_trace_config.bin .
        fi

        if [ -d /lib/firmware/$arch/WIFI_FW/qcn9000 ]; then
                if [ -e /lib/firmware/$arch/WIFI_FW/qcn9000/board-2.bin ]; then
                        mkdir -p /lib/firmware/ath11k/QCN9074/hw1.0/
                        cd /lib/firmware/ath11k/QCN9074/hw1.0/
                        ln -s /lib/firmware/$arch/WIFI_FW/qcn9000/board-2.bin .
                        ln -s /tmp/qcn9000/caldata*.bin .
                        ln -s /lib/firmware/$arch/WIFI_FW/qcn9000/m3.bin .
                        ln -s /lib/firmware/$arch/WIFI_FW/qcn9000/amss.bin .
                        ln -s /lib/firmware/$arch/WIFI_FW/qcn9000/qdss_trace_config.bin .
                fi
        fi

        if [ -d /lib/firmware/$arch/WIFI_FW/qcn9100 ]; then
                if [ -e /lib/firmware/$arch/WIFI_FW/qcn9100/board-2.bin ]; then
                        mkdir -p /lib/firmware/ath11k/qcn9100/hw1.0/
                        cd /lib/firmware/ath11k/qcn9100/hw1.0/
                        ln -s /lib/firmware/$arch/WIFI_FW/qcn9100/board-2.bin .
                        ln -s /lib/firmware/qcn9100/caldata*.bin .
                        ln -s /lib/firmware/$arch/WIFI_FW/qcn9100/qdss_trace_config.bin .
                fi
        fi

        if [ -d /lib/firmware/$arch/WIFI_FW/qcn6122 ]; then
                if [ -e /lib/firmware/$arch/WIFI_FW/qcn6122/board-2.bin ]; then
                        mkdir -p /lib/firmware/ath11k/qcn6122/hw1.0/
                        cd /lib/firmware/ath11k/qcn6122/hw1.0/
                        ln -s /lib/firmware/$arch/WIFI_FW/qcn6122/board-2.bin .
                        ln -s /lib/firmware/qcn6122/caldata*.bin .
                        ln -s /lib/firmware/$arch/WIFI_FW/qcn6122/qdss_trace_config.bin .
                fi
        elif [ -d /lib/firmware/$arch/WIFI_FW/qcn9100 ]; then
                if [ -e /lib/firmware/$arch/WIFI_FW/qcn9100/board-2.bin ]; then
                        mkdir -p /lib/firmware/ath11k/qcn6122/hw1.0/
                        cd /lib/firmware/ath11k/qcn6122/hw1.0/
                        ln -s /lib/firmware/$arch/WIFI_FW/qcn9100/board-2.bin .
                        ln -s /lib/firmware/qcn9100/caldata*.bin .
                        ln -s /lib/firmware/$arch/WIFI_FW/qcn9100/qdss_trace_config.bin .
                fi
        fi

        mkdir -p /vendor/firmware
        mv /lib/firmware/$arch/WIFI_FW/Data.msc /vendor/firmware
}

mount_adsp_fw (){
        local emmc_part=""
        local nand_part=""
        local nor_part=""
        local ubi_part_name="rootfs"
        local part_name="0:ADSPFW"
        local arch=""

        if mount | grep -q ADSP_FW; then
                return 0
        fi

        arch=$1
        emmc_part=$(find_mmc_part $part_name 2> /dev/null)
        nor_part=$(cat /proc/mtd | grep ADSPFW | awk '{print $1}' | sed 's/:$//')
        local nor_flash=`find /sys/bus/spi/devices/*/mtd -name ${nor_part}`
        nand_part=$(find_mtd_part $ubi_part_name 2> /dev/null)
        mkdir -p /lib/firmware/$arch/ADSP_FW

        if [ -n "$emmc_part" ]; then
                /bin/mount -t squashfs $emmc_part /lib/firmware/$arch/ADSP_FW > /dev/console 2>&1
                [ -f /rom/lib/firmware/$arch/ADSP_FW/q6_fw.mdt ] && cp /rom/lib/firmware/$arch/ADSP_FW/*.* /lib/firmware/$arch/ADSP_FW/
        elif [ -n "$nor_flash" ]; then
                local nor_mtd_part=$(find_mtd_part $part_name 2> /dev/null)
                if [ -n "$nor_mtd_part" ]; then
                        /bin/mount -t squashfs $nor_mtd_part /lib/firmware/$arch/ADSP_FW > /dev/console 2>&1
                fi
        elif [ -n "$nand_part" ]; then
                local PART=$(grep -w  "rootfs" /proc/mtd | awk -F: '{print $1}')
                ubiattach -p /dev/$PART
                sync
                local ubi_part=$(find_mtd_part adsp_fw 2> /dev/null)
                if [ -n "$ubi_part" ]; then
                        /bin/mount -t squashfs $ubi_part /lib/firmware/$arch/ADSP_FW > /dev/console 2>&1
                fi
        fi

        if [ -f /lib/firmware/$arch/ADSP_FW/image/adsp.mdt ]; then
                echo " ADSP FW mount is successful" > /dev/console 2>&1
        fi

        cd  /lib/firmware/$arch &&  ln -s ADSP_FW/image/*.* .
        [ -d /lib/firmware/$arch/ADSP_FW/dspso ] && ln -s /lib/firmware/$arch/ADSP_FW/dspso /dsp
}

mount_bt_fw (){
        local emmc_part=""
        local nand_part=""
        local nor_part=""
        local ubi_part_name="rootfs"
        local part_name="0:BTFW"
        local arch=""
        local nor_flash=""
        local nor_mtd_part=""
        local PART=""
        local ubi_part=""

        if mount | grep -q BT_FW; then
                return 0;
        fi

        arch=$1
        emmc_part=$(find_mmc_part $part_name 2> /dev/null)
        nor_part=$(cat /proc/mtd | grep BTFW | awk '{print $1}' | sed 's/:$//')
        nor_flash=`find /sys/bus/spi/devices/*/mtd -name ${nor_part}`
        nand_part=$(find_mtd_part $ubi_part_name 2> /dev/null)

        mkdir -p /lib/firmware/$arch/BT_FW

        if [ -n "$emmc_part" ]; then
                /bin/mount -t squashfs $emmc_part /lib/firmware/$arch/BT_FW > /dev/console 2>&1
                [ -f /rom/lib/firmware/$arch/BT_FW/bt_fw.mdt ] && cp /rom/lib/firmware/$arch/BT_FW/*.* /lib/firmware/$arch/BT_FW/
        elif [ -n "$nor_flash" ]; then
                nor_mtd_part=$(find_mtd_part $part_name 2> /dev/null)
                /bin/mount -t squashfs $nor_mtd_part /lib/firmware/$arch/BT_FW > /dev/console 2>&1
        elif [ -n "$nand_part" ]; then
                PART=$(grep -w  "rootfs" /proc/mtd | awk -F: '{print $1}')
                ubiattach -p /dev/$PART
                sync
                ubi_part=$(find_mtd_part bt_fw 2> /dev/null)
                /bin/mount -t squashfs $ubi_part /lib/firmware/$arch/BT_FW > /dev/console 2>&1
        fi

        if [ -f /lib/firmware/$arch/BT_FW/image/bt_fw_patch.mdt ]; then
                echo "BT FW mount is successful" > /dev/console 2>&1
                mkdir /tmp/BT_FW &&  cp -r /lib/firmware/$arch/BT_FW/image/ /tmp/BT_FW
                umount /lib/firmware/$arch/BT_FW
        else
                echo "BT FW mount is failed" > /dev/console 2>&1
        fi

        cd /lib/firmware/$arch && ln -s /tmp/BT_FW/image/*.* .
}

boot() {
 . /lib/functions/system.sh
        local board=$(board_name)

        case "$board" in
                ap-hk* | ap-ac* | ap-oa*)
                        mount_wifi_fw "IPQ8074"
                ;;
                ap-cp01* | ap-cp03*)
                        mount_wifi_fw "IPQ6018"
                ;;
                ap-cp02*)
                        stop_adsp_fw "IPQ6018"
                ;;
                ax6000)
                        mount_wifi_fw "IPQ5018"
                        mount_bt_fw "IPQ5018"
                ;;
                *)
                        echo "\nInvalid Target"
                ;;
        esac
}

stop_wifi_fw() {
    return 0
}

stop_adsp_fw() {
        local emmc_part=""
        local nand_part=""
        local nor_part=""
        local part_name="0:ADSPFW"
        arch=$1

        emmc_part=$(find_mmc_part $part_name 2> /dev/null)
        nor_part=$(cat /proc/mtd | grep ADSPFW | awk '{print $1}' | sed 's/:$//')
        local nor_flash=`find /sys/bus/spi/devices/*/mtd -name ${nor_part}`
        nand_part=$(find_mtd_part rootfs 2> /dev/null)
        if [ -n "$emmc_part" ]; then
                umount /lib/firmware/$arch/ADSP_FW
        elif [ -n "$nor_flash" ]; then
                local nor_mtd_part=$(find_mtd_part $part_name 2> /dev/null)
                umount /lib/firmware/$arch/ADSP_FW
        elif [ -n "$nand_part" ]; then
                umount /lib/firmware/$arch/ADSP_FW
        fi
}

stop_bt_fw() {
        local emmc_part=""
        local nand_part=""
        local nor_part=""
        local part_name="0:BTFW"
        local nor_mtd_part=""
        local nor_flash=""
        arch=$1

        emmc_part=$(find_mmc_part $part_name 2> /dev/null)
        nor_part=$(cat /proc/mtd | grep BTFW | awk '{print $1}' | sed 's/:$//')
        nor_flash=`find /sys/bus/spi/devices/*/mtd -name ${nor_part}`
        nand_part=$(find_mtd_part rootfs 2> /dev/null)
        if [ -n "$emmc_part" ]; then
                umount /lib/firmware/$arch/BT_FW
        elif [ -n "$nor_flash" ]; then
                nor_mtd_part=$(find_mtd_part $part_name 2> /dev/null)
                umount /lib/firmware/$arch/BT_FW
        elif [ -n "$nand_part" ]; then
                umount /lib/firmware/$arch/BT_FW
        fi
}

stop() {
 . /lib/functions/system.sh
        local board=$(board_name)

        case "$board" in
                ap-hk* | ap-ac* | ap-oa*)
                        stop_wifi_fw "IPQ8074"
                ;;
                ap-cp01* | ap-cp03*)
                        stop_wifi_fw "IPQ6018"
                ;;
                ap-cp02*)
                        stop_adsp_fw "IPQ6018"
                ;;
                ax6000)
                        stop_wifi_fw "IPQ5018"
                        stop_bt_fw "IPQ5018"
                ;;
                *)
                        echo "\nInvalid Target"
                        return 0
                ;;
        esac
        return 0
}
773

Of cause QSDK is working as that contains proprietary QCA wifi.
The mentioned wifi_mount script only mounts the wifi firmware partition, nothing else.

But we are using the open source ath11k wifi driver and there are stiill some bugs regarding PCI wifi.

774

@all ... I think it needs to be very clear to anyone that is to acquire this device that one has to get the chinese version. Unless there is new info that one can install openwrt on the international version ... happy to get demolished here but I haven't seen evidence yet that one can bypass the u-boot process in the international version as in the ax3600

1 Like
775

I had the same 1643 issues. For me, it was caused by LuCI not accessible on http://169.254.31.1/. Check if your LuCI is reachable from 169.254.31.1. (credit to xuwenbing)

Doing wget http://169.254.31.1/cgi-bin/luci/api/xqsystem/token on the router should be enough.

776

Hi @robimarko
After looking into your submitted pach to ath11k dt-bindings and to the qmi.c, I'm wondering if this fix wouldn't solve our ongoing issue with ath11k and qmi multiple soc that affects AX9000?

777

No, it has nothing to do with it.
Again, its a QCA issue and they are "working on it"

2 Likes
778

You are right Robi.
The necessary changes would probably require much more significant changes to the ath11k driver and maybe even the binary firmware.
So, people like me who are waiting for the full AX9000 support need to arm themselves with a lot of patience.

Edit: I had a follow up chat with Jeff (QCN guy who confirmed the issue with qmi multiple soc) and he reckons the issue is only applicable if we have several the same instances (like 2x QCN9074).
He suggested to check qrtr id (i.e. for QCN6390 should be 0x1 and for QCN9074 0x7)
If that is the case we wouldn't need to wait for mentioned patch

4 Likes
779

@robimarko
Regarding your latest AX9000 build on github, I have some questions :

  • Does 2.4 Ghz AX & 5 Ghz @ 80 Mhz are working?
  • I assume it's really for chinese version?, will it work with 2021 ('Enhanced' version) of chinese AX9000?
  • I found this script which seems simplify for gaining the SSH access on AX9000, how to obtain the STOK ?

Thanks a lot for supporting AX9000 :smiley:!

780

I wont repeat answers to the same questions over and over, its all been answered in this thread

5 Likes
781

ax9000

My ax9000 only up for around 3 hours and getting above requests, this is why we need OpenWRT.

2 Likes
782

for those interested, it is currently priced at 189€, delivered from Spain. delivery time 3-5 business days.

1 Like
783

Eu or cn version?

784

Should be EU, so secure boot enabled

785

I am wondering if anyone tried flashing new ax9000 image from Robi after rebasing backports?

1 Like
786

Sirs i have a chinese ax9000 can i use openwrt can some guide me how to do it and can i turn off led lights of this routers since mi home app broken
I know this must have been asked before but noobie hwre

Stock version 1.041 do i have a chance

787

Hi @brainslayers
The procedure for flashing this device is "higher up in that very thread" (i.e. OpenWrt support for Xiaomi AX9000 - #179 by bruda)
It has been also described in robi's commit for that device: https://github.com/robimarko/openwrt/commit/7127d0ddbdf8c3fefd0048d1b8235d4152b1b67b
But I am afraid this is the end of good news... While we could get an exploit to work on Chinese firmware, there are some fundamental issues with the WiFi driver (+ some PCIe driver issues) so not everything works with OpenWRT.
And until these issues are resolved, there is probably no point in flashing OpenWRT into that device, not to mention some risks (you can brick your device if you don't know what you are doing)

1 Like
788

Thanks for the heads up

789

Hi, I am was so happy with AX3600 development state and its usability, that I decided to get AX9000 (CN)

just have few questions

  1. Not working * Fan controller (Lacking driver)
    so FAN spins constant speed or it is not working at all?

  2. Not working * QCN9024 (Most of the 5GHz band, actually works but cannot be used simultaneously with the AHB radio)
    so With AHB disabled radio1 and radio2 would be disabled and radio0 IOT and QCN9024 would be available? (this is also a satysfying scenario in my opinion)
    What was last working snapshot with QCN9024 working and was it usable? (if ever was usable)

  3. radio1(5.8GHz antennas) and radio2(2.4GHz are CN5024, but there are two colliding informations about

by @robimarko
OpenWrt support for Xiaomi AX9000 - For Developers - OpenWrt Forum
platform/soc/c000000.wifi radio1 5g Wiphy phy1 wiphy index: 1 5.8GHz
5180 MHz [36]-5240 MHz [48] (30.0 dBm) U-NII-1
5260 MHz [52]-5320 MHz [64] (24.0 dBm) (radar detection) U-NII-2a
5500 MHz [100]-5720 MHz [144] (24.0 dBm) (radar detection) U-NII-2c
5745 MHz [149]-5825 MHz [165] (30.0 dBm) U-NII-3
5845 MHz [169]-5865 MHz [173] (30.0 dBm) U-NII-4

and by @avalentin
OpenWrt support for Xiaomi AX9000 - For Developers - OpenWrt Forum
5745 MHz [149]-5825 MHz [165] (30.0 dBm) U-NII-3

which it is then?

  1. is regulatory still messed up?

  2. how is radio1 and radio2 performance compared to AX3600?

790

The router is a monster in terms of wifi range and speed i can say that owned it for 12 months but i have only run the stock fw which is limited in terms of chinese language and options i use it as ap

1 Like
791

  1. There is no driver for the fan controller, so the fan doesn't do anything.

  2. Known issue, nothing can be done until QCA sorts out AHB and PCI support concurrently.
    QCN9024 works, but then you cannot use the 2G radio

  3. Depends on what regulatory you selected

2 Likes