OpenWrt support for Xiaomi AX9000

For Developers
1059

Here's the info from the OpenWRT page.

An issue on the lower 5 GHz band radio (QCN9024) caused by the current BDF file (as 17/12/2022) is leading to non-connecting issues. Proposed by avanletin, a workaround is available, following the instructions below:
Paste the entire command into a linux terminal to generate a new BDF file board-2.bin compressed.
Backup the current board-2.bin file on the AX9000: cd /lib/firmware/ath11k/QCN9074/hw1.0 && mv ./board-2.bin ./board-2.bin_stock.
Copy the compressed file generic-ax9000.tar.gz into the root directory (/) on the AX9000.
Uncompress the BDF file: tar -xvf generic-ax9000.tar.gz.
Reboot the router.
Although the new BDF file configuration allows otherwise, configure the QCN9024 radio exclusively on the 36,40,44,48,52,56,60 or 64 channels.

1 Like
1060

Dear all,

Please help me with this issue. I have obtained an international version of AX9000, as I own 2 AX3600s and they are working well with Openwrt with Robis fork and then the snapshot. Thanks again for the work Robi, please enjoy your coffees :slight_smile:

Getting telnet / ssh was not a problem.
I tried to flash with the following process:

login as: root
root@192.168.31.1's password:


BusyBox v1.25.1 (2021-08-08 11:32:45 UTC) built-in shell (ash)

 -----------------------------------------------------
       Welcome to XiaoQiang!
 -----------------------------------------------------
  $$$$$$\  $$$$$$$\  $$$$$$$$\      $$\      $$\        $$$$$$\  $$\   $$\
 $$  __$$\ $$  __$$\ $$  _____|     $$ |     $$ |      $$  __$$\ $$ | $$  |
 $$ /  $$ |$$ |  $$ |$$ |           $$ |     $$ |      $$ /  $$ |$$ |$$  /
 $$$$$$$$ |$$$$$$$  |$$$$$\         $$ |     $$ |      $$ |  $$ |$$$$$  /
 $$  __$$ |$$  __$$< $$  __|        $$ |     $$ |      $$ |  $$ |$$  $$<
 $$ |  $$ |$$ |  $$ |$$ |           $$ |     $$ |      $$ |  $$ |$$ |\$$\
 $$ |  $$ |$$ |  $$ |$$$$$$$$\       $$$$$$$$$  |       $$$$$$  |$$ | \$$\
 \__|  \__|\__|  \__|\________|      \_________/        \______/ \__|  \__|


root@XiaoQiang:~# nvram set atf="1" && nvram commit && reboot
root@XiaoQiang:~#
Using username "root".
root@192.168.31.1's password:
Send automatic password


BusyBox v1.25.1 (2021-08-08 11:32:45 UTC) built-in shell (ash)

 -----------------------------------------------------
       Welcome to XiaoQiang!
 -----------------------------------------------------
  $$$$$$\  $$$$$$$\  $$$$$$$$\      $$\      $$\        $$$$$$\  $$\   $$\
 $$  __$$\ $$  __$$\ $$  _____|     $$ |     $$ |      $$  __$$\ $$ | $$  |
 $$ /  $$ |$$ |  $$ |$$ |           $$ |     $$ |      $$ /  $$ |$$ |$$  /
 $$$$$$$$ |$$$$$$$  |$$$$$\         $$ |     $$ |      $$ |  $$ |$$$$$  /
 $$  __$$ |$$  __$$< $$  __|        $$ |     $$ |      $$ |  $$ |$$  $$<
 $$ |  $$ |$$ |  $$ |$$ |           $$ |     $$ |      $$ |  $$ |$$ |\$$\
 $$ |  $$ |$$ |  $$ |$$$$$$$$\       $$$$$$$$$  |       $$$$$$  |$$ | \$$\
 \__|  \__|\__|  \__|\________|      \_________/        \______/ \__|  \__|


root@XiaoQiang:~# nvram get flag_boot_rootfs
0
root@XiaoQiang:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00100000 00020000 "0:SBL1"
mtd1: 00100000 00020000 "0:MIBIB"
mtd2: 00080000 00020000 "0:BOOTCONFIG"
mtd3: 00080000 00020000 "0:BOOTCONFIG1"
mtd4: 00300000 00020000 "0:QSEE"
mtd5: 00300000 00020000 "0:QSEE_1"
mtd6: 00080000 00020000 "0:DEVCFG"
mtd7: 00080000 00020000 "0:DEVCFG_1"
mtd8: 00080000 00020000 "0:APDP"
mtd9: 00080000 00020000 "0:APDP_1"
mtd10: 00080000 00020000 "0:RPM"
mtd11: 00080000 00020000 "0:RPM_1"
mtd12: 00080000 00020000 "0:CDT"
mtd13: 00080000 00020000 "0:CDT_1"
mtd14: 00080000 00020000 "0:APPSBLENV"
mtd15: 00100000 00020000 "0:APPSBL"
mtd16: 00100000 00020000 "0:APPSBL_1"
mtd17: 00080000 00020000 "0:ART"
mtd18: 00080000 00020000 "bdata"
mtd19: 00080000 00020000 "crash"
mtd20: 00080000 00020000 "crash_syslog"
mtd21: 03800000 00020000 "rootfs"
mtd22: 03800000 00020000 "rootfs_1"
mtd23: 00100000 00020000 "cfg_bak"
mtd24: 07d80000 00020000 "overlay"
mtd25: 005ef000 0001f000 "kernel"
mtd26: 02017000 0001f000 "ubi_rootfs"
mtd27: 00ae6000 0001f000 "rootfs_data"
mtd28: 03013000 0001f000 "data"
root@XiaoQiang:~# ubiformat /dev/mtd22 -y -f /tmp/openwrt-ipq807x-generic-xiaomi
_ax9000-squashfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_l
ast_success=1 && nvram commit
ubiformat: mtd22 (nand), size 58720256 bytes (56.0 MiB), 448 eraseblocks of 1310                                                                                        72 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 447 -- 100 % complete
ubiformat: 316 eraseblocks have valid erase counter, mean value is 0
ubiformat: 132 eraseblocks are supposedly empty
ubiformat: warning!: only 316 of 448 eraseblocks have valid erase counter
ubiformat: mean erase counter 0 will be used for the rest of eraseblock
ubiformat: use erase counter 0 for all eraseblocks
ubiformat: flashing eraseblock 108 -- 100 % complete
ubiformat: formatting eraseblock 447 -- 100 % complete
root@XiaoQiang:~# nvram get atf
1
root@XiaoQiang:~# nvram get flag_boot_rootfs
1
root@XiaoQiang:~# nvram get flag_last_success
1
root@XiaoQiang:~# reboot
root@XiaoQiang:~#

It always fail, I tried with Robi's build and the snapshots, initram or squashfs factory.. The router never boots, I need to recover with miwifi..
There is a difference between the packages

  • If squashfs is flashed, the LEDs are solid orange and wan port led is solidly lit also.
  • with initramfs the orange LEDs are on for a few secs then off for a sec, then on again. It seem to bootloop.

I dont have UART, as of now.

Any suggestions please? I would highly appreciate any help, I bought the device specifically for Openwrt..

Thank you!

Peter

Edit: I have ordered already my 1.8V TTL, it will take some time to arrive. Till then either we solve it or the AX3600s will remain at duty :slight_smile:

1 Like
1061

Welcome to the AX9000 int club. Confirming your findings. I'm also waiting for my 1.8v TTL adapter.

1062

Ugh, I just dont see what they could have changed.

Maybe they messed with the kernel load address so there is not enough space to decompress it

1063

Would that be something with the stock fw version?

I tried flashing on 3.0.33 and 3.0.40, both the same..

1064

No, it would be bootloader related

1065

Thanks for your answers :slight_smile:

Oh great, that is not something to be touched I guess due to the high risks involved.

Could this be circumnavigated with UART?

1066

Well, we can tweak the kernel load address in the build as that is part of uImage, but until somebody captures what bootloader is doing its hard to guess

1 Like
1067

Damn.. I could not find UART USB in my country (Hungary) with 1.8v level, had to order from aliexpress. Will take forever to arrive :smiley:

1068

That is why I keep a stack of Aliexpress FT232RL-s, but I actually need to order a bunch more as they keep dissapearing

1069

I have many of them, never needed anything else, but 3.3v or 5v :smiley: of course none of them can go this low

1070

If they are those red FT232RL they work on 1.8V if they are in 3.3V mode, I am using those

1071

20230124_221143
20230124_2211433468×4624 522 KB

20230124_221138
20230124_2211383468×4624 880 KB

I have this one, I will give it a try tomorrow then :slight_smile:

1072

Thats the one, I am using those on 1.8V gear including ipq807x

1 Like
1073

The wiki is advising in red not to do this, that's why I did not! Great news :slightly_smiling_face:

Thanks Robi, I will get back here tomorrow!

1074

That is correct but FT232RL is 1.8V I/O capable

1 Like
1075

But they output 3.3V or 1.8V in Tx/Rx with the jumper set to 3.3V?

1076

I suppose it autodetects what is coming on RX as I have been using it for years on ipq807x just fine

1077

Earlier in this dicussion Matezon stated:

Is this the kernel load address needed ?

1078

It is the default where bootloader will load the kernel and then try to boot it, 0x42000000 is too low.
Other devices all use 0x44000000, including CN AX9000.