Hi!
The current wiki page for the AX9000 does not have not any instruction on how to flash your experimental builds, after getting SSH working. The AX3600 page has those instructions.
Where can I find the specific and proper ones for the AX9000?
Thanks.
EDIT: Found them: https://github.com/robimarko/openwrt/commit/0ee958d979af8d7b01fe4743dd5190715aa74cb5
The wikipage is now updated and better organized: https://openwrt.org/inbox/toh/xiaomi/ax9000
Any work around to get the PCI 5G working correctly? 
Well, only using generic BDF so far
I can provide a patched BDF, but you have to make sure to use the lower channels.
Yes please. Only using channel 36
Yes please 
may I have the patch BDF please? I will use channel 36 only!
sorry to bother but does anyone know how to enable the ap using aiot antenna (aka qca9889) in the stock firmware?
i have had an ax6 and ax5 which usually rebooted because of some 3rd party firmwares little bug so i prefer adding little patches to stock firmware
xiaomi engineers have wasted the qca9889 chip by using it only to discover some non-inited mijia iot device, so i wonder we could make the main 2.4G wireless network has more Channel Idle Time (means more faster) by using it as an open ap and let our iot device connected with it...
ive tried this config but no seem to work normal
config wifi-device 'wifi3'
option type 'qcawificfg80211'
option channel '6'
option country 'US'
option macaddr '********'
option hwmode '11ng'
option htmode 'HT40'
option disabled '0'
option txpower '10'
option txbf '0'
option bw '0'
option ax '0'
option dbglog_disable '0'
config wifi-iface 'dev'
option device 'wifi3'
option ifname 'wl3'
option network 'lan'
option mode 'ap'
option ssid 'dev'
option encryption 'ccmp'
option key '123123123'
option psk '123345567'
option disabled '0'
option rrm '0'
option bsd '0'
option wnm '0'
theres some dmesg error info (only error, normal info not pasted)
wlan: [19284:W:ANY] check_path_exists: 269: Path /lib/firmware/AR9887/utf.codeswap.bin doesnt exist
wlan: [19284:W:ANY] check_path_exists: 269: Path /lib/firmware/AR9887/utf.dataswap.bin doesnt exist
wlan: [111:E:TIF] init_deinit_sw_version_check: 2717: host/RAM_fw Build Ver Mismatch: H:0x17, F:0x0 !
wlan: [111:E:TIF] init_deinit_sw_version_check: 2732: host/RAM_fw uses same Ver: Major:0x1, Minor:0x0,Release:0x0, Build:0x17
wlan: [111:E:TIF] init_deinit_populate_fw_version_cmd: 108: failed to save fw version
wlan: [111:E:TIF] init_deinit_ready_event_handler: 503: agile capability disabled in HW
wlan: [19284:I:ANY] __ol_ath_check_wmi_ready: 5497: ABI Version mismatch: Host(0x3), Target(0x0)
wlan: [19284:E:CFR] tgt_cfr_init_pdev: 120: Error occurred with exit code 11
wlan: [19284:I:ANY] ol_ath_thermal_mitigation_attach: 1591: ol_ath_thermal_mitigation_attach: TT not supported in FW
wlan: [11749:I:ANY] ol_acfg_handle_wifi_ioctl: 447: ol_acfg_handle_wifi_ioctl: req->cmd=76 not valid for radio interface, it's for VAP
wlan: [0:I:ANY] ol_ath_set_config_param: 2442: Disconnect_timeout value: 10
wlan: [0:I:ANY] ol_ath_set_config_param: 2448: Reconfiguration_timeout value:60
wlan: [19402:I:ANY] Failed to create bss node
wlan: [19646:I:ANY] wlan_set_param: 3234: HE MU BFER is not allowed in current mode
wlan: [19651:I:ANY] wlan_set_param: 3082: HE Ul MU MIMO is not allowed in current mode
I followed our wiki page and wanted to flash AX9000CN with OpenWrt
Used AX3600 with latest OpenWrt as "unlocking" device,
when AX9000CN is connected to AX3600 browser privdes error message
{"msg":"一键换机过程中请求对端接口失败","code":1643}
tried on FW:
miwifi_ra70_all_39f59_1.0.82.bin
miwifi_ra70_firmware_d96a4_1.0.108.bin
do you have any insights what can be wrong?
The behaviour or configuration of the OEM firmware, beyond the bare minimum of what's needed to get OpenWrt flashed, is off topic in this thread (and this forum as a whole). Please use Xiaomi's support channels for those discussions.
okay ive tried robimarko's firmware and qca9889 works fine
ill continue dig out cuz mi "support" or "forum" equals a joke with no laugh 
but ax9000 also quiet a joke which qca9889 does not really support dbdc lol
No one said it would.
well xiaomi said 9000
it should be 8850
Could you share some insights on how to do that SPI flash dump?
The hardware way would be to unsolder W29N02GZ and use some TSOP48 adapter to dump its contents with flashrom or alike.
As for the software way, I personally do not know what exactly OpenWrt can offer. Perhaps you can use flashrom right from OpenWrt, but likely not. In this case you can probably dump partitions with nanddump one by one. Running cat /proc/mtd should list which partitions are available, and then you can dump them as long as the hardware does not protect them from reading.
A can read all mtd, except from the 25 up to 28:
dev: size erasesize name
mtd0: 00100000 00020000 "0:SBL1"
mtd1: 00100000 00020000 "0:MIBIB"
mtd2: 00080000 00020000 "0:BOOTCONFIG"
mtd3: 00080000 00020000 "0:BOOTCONFIG1"
mtd4: 00300000 00020000 "0:QSEE"
mtd5: 00300000 00020000 "0:QSEE_1"
mtd6: 00080000 00020000 "0:DEVCFG"
mtd7: 00080000 00020000 "0:DEVCFG_1"
mtd8: 00080000 00020000 "0:APDP"
mtd9: 00080000 00020000 "0:APDP_1"
mtd10: 00080000 00020000 "0:RPM"
mtd11: 00080000 00020000 "0:RPM_1"
mtd12: 00080000 00020000 "0:CDT"
mtd13: 00080000 00020000 "0:CDT_1"
mtd14: 00080000 00020000 "0:APPSBLENV"
mtd15: 00100000 00020000 "0:APPSBL"
mtd16: 00100000 00020000 "0:APPSBL_1"
mtd17: 00080000 00020000 "0:ART"
mtd18: 00080000 00020000 "bdata"
mtd19: 00080000 00020000 "crash"
mtd20: 00080000 00020000 "crash_syslog"
mtd21: 03800000 00020000 "rootfs"
mtd22: 03800000 00020000 "rootfs_1"
mtd23: 00100000 00020000 "cfg_bak"
mtd24: 07d80000 00020000 "overlay"
mtd25: 005ef000 0001f000 "kernel"
mtd26: 02017000 0001f000 "ubi_rootfs"
mtd27: 00ae6000 0001f000 "rootfs_data"
mtd28: 03013000 0001f000 "data"
Which one do you need?
To be honest, no idea. Need something that has U-Boot in it, but I cannot relate any of these names with the U-Boot or a bootloader of some kind. Perhaps it is invisible or merged with one of the listed partitions. Could you please dump all you can and upload them here?
APPSBL is U-boot
Reading from ssh shell the mtd14, the output is this (anonymized):
ubootcmd=tftp
bootdelay=5
SN=AAAAAAA/BBBBBBBBBBBBBB
ethaddr="00:AA:BB:CC:DD:10"
ipaddr=192.168.31.1
serverip=192.168.31.100
stdin=serial
stdout=serial
stderr=serial
uart_en=1
telnet_en=1
wl0_ssid=xiaomi-router-ra70_miap4ed7_5G
wl1_ssid=xiaomi-router-ra70_miap4ed7
wl0_radio=1
wl1_radio=1
boot_wait=on
flag_boot_rootfs=0
no_wifi_dev_times=0
flag_boot_type=2
flag_last_success=0
flag_ota_reboot=0
color=100
CountryCode=BE
miot_did=AAAAAAAAAAAAA
miot_key=BBBBBBBBBBBBBBBBBBBBBBB
wl2_ssid=xiaomi-router-ra70_4ed7_Game
nv_wan_type=dhcp
flag_boot_success=1
flag_try_sys1_failed=0
flag_try_sys2_failed=0
mode=Router
model=RA70
Router_unconfigured=0
nv_sys_pwd=27cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAde7
nv_wifi_ssid=Xiaomi_4ED7
nv_wifi_enc=psk2
nv_wifi_pwd=1234567890
nv_wifi_ssid1=Xiaomi_4ED7_5G_Game
nv_wifi_enc1=psk2
nv_wifi_pwd1=1234567890
restore_defaults=0
ssh_en=1