OpenWrt support for Xiaomi AX9000

rdlvm · August 20, 2023, 7:02pm

OpenWrt SNAPSHOT r23782-ac68fbf526 / LuCI Master git-23.223.85458-f7583b6

No script.

NathanCreatives · August 21, 2023, 2:42am

This works the BDF is still preserved after sysupgrade

GeoffWilliams · August 23, 2023, 2:05pm

Thanks so much for making this router run openWRT!

I got a new Chinese version off AliExpress (black box) and had a few steps to make this thing work with SSH - documenting here for any new buyers. The "normal" setup was very strange too and not like any other router Ive seen. Heres what to do with a fresh box:

Connect router by Ethernet
Browse to 192.168.31.1 Use google translate to read the Chinese into English, start a WIFI hotspot on your phone and connect to it. Tick the box to set password to the WIFI password
Now the screen gives a big tick, disconnect the Ethernet cable and connect to the WIFI SSID matching your hotspot but with "5G" appended - its the same password as your hotspot
Find out what IP was allocated to your computer on WIFI and scan the whole subnet, eg I had:

My IP: 192.168.245.XXX (eg)
Scan the subnet: nmap 192.168.245.0/2
This found the router at 192.168.245.26

Connect to the new router IP in browser
Go to https://blog.kevingu.net/xiaomi-ax9000-router-ssh-shellclash and download ax9000-ssh-access.7z
Extract the .7z file and flash the miwifi_ra70_all_39f59_1.0.82.bin file using "manual" firmware update. Click the box to wipe settings and the router reboots. This version seems to work. I wasnt able to downgrade to the other old firmware images on the openWRT wiki page
Repeat the steps above to connect to WIFI and open the web page again
Run the .js script to extract the password and save it
Now follow the instructions on the blog page, which are the same ones everyone else has been posting - however - the exploit script in the .7z file is updated vs the other .js files on this thread (unless i missed some).
When running the script be sure to leave region as CN. There is only one exploit script because international is not supported (HDR2/secure boot?)
Download the exploit zip file, unpack, upload the 1.bin, 2.bin, 3.bin etc
After the final reboot you should have a TELNET server so connect to telnet as user "root" with password from earlier
Now enable SSH - the init script has an NVRAM setting check thats not in the instructions so you need:

nvram set ssh_en=1

Paste the instructions to enable and start SSH from the blog
Now SSH in. If your on a recent Linux you have to enable the old algorithm:

ssh -oHostKeyAlgorithms=+ssh-rsa  root@192.168.245.26

SCP doesnt work due to missing programs:

ash: /usr/libexec/sftp-server: not found

...So just download using curl on the router itself:

cd /tmp
curl -k -O https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-xiaomi_ax9000-initramfs-factory.ubi

Now you can install openWRT! Read the openWRT wiki page instructions for Chinese OEM carefully, then read again! You are installing openwrt to the opposite partition that the system is running from and setting the partition to boot from in one command.

After rebooting, plug Ethernet back in, you should see your PC allocated a 192.168.1.XXX address and the router should now be available at 192.168.1.1 via SSH, username root, no password! There is no Web GUI (LUCI) until you hookup the WAN socket or otherwise setup Internet access to install LUCI with opkg.

Good luck!

mattimat · August 23, 2023, 2:19pm

I installed rc3, I had to replace the board-2.binto get the radio3 working. Everything seems to be ok.

mgibbons51 · August 24, 2023, 1:55am

Thanks for this. Worked for me updating to RC3 just gonna have wait until we hear the working BDF is included in the build otherwise. Then remove the script then.

seemebreakthis · August 24, 2023, 6:50am

Just so you know, for the Chinese version I got a few weeks back, all I had to do was to follow the instructions in the wiki page and that got me as far as running Openwrt initramfs rom. Then I followed OpenWrt support for Xiaomi AX9000 - #1611 by scr4tchy to make both partitions run 23.05.0-rc2 Openwrt.

I don't remember what version of stock firmware my router was on, but no downgrading was needed at all. Also the links to all the exploit scripts in the wiki all seem to work fine.

But whatever the method, as long as we get the same end result, that's the important thing !

BL4CKR4Y · August 24, 2023, 2:21pm

does anybody know what the top performance or speed of Wireguard on Xiaomi AX9000? i mean what the max bandwidth or speed it could reach? i cant check it myself right now because i dont have highspeed or Gigabit internet right now to check it

leeo · August 25, 2023, 6:34am

hi, can u tell me which version of fireware you flash?

ElSergio · August 25, 2023, 1:17pm

How to get the package working on 23-rc3?? I can't see it as "install" package.

clark · August 25, 2023, 1:50pm

immortalwrt

seemebreakthis · August 25, 2023, 5:21pm

Some of my new findings / issue (with 23.05-rc2 (no chance yet to move to rc3)):

For radio0, if I set it to N mode / 2.4GHz, I see these error messages every few minutes, and the AP becomes virtually unusable:

Sat Aug 26 00:58:16 2023 kern.warn kernel: [448423.990008] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:36 2023 kern.warn kernel: [448444.061053] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:36 2023 kern.warn kernel: [448444.163456] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:36 2023 kern.warn kernel: [448444.265860] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:36 2023 kern.warn kernel: [448444.368266] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:36 2023 kern.warn kernel: [448444.470667] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:36 2023 kern.warn kernel: [448444.573065] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:37 2023 kern.warn kernel: [448444.675473] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:37 2023 kern.warn kernel: [448444.777880] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:37 2023 kern.warn kernel: [448444.880283] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:37 2023 kern.warn kernel: [448444.982692] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:37 2023 kern.warn kernel: [448445.085088] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:37 2023 kern.warn kernel: [448445.187494] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:37 2023 kern.warn kernel: [448445.289900] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:37 2023 kern.warn kernel: [448445.392303] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
Sat Aug 26 00:58:37 2023 kern.warn kernel: [448445.494700] ath10k_pci 0001:01:00.0: SWBA overrun on vdev 0, skipped old beacon
r

Setting to AC / 5GHz and things become ok. I suspect Legacy mode 2.4GHz will also work but I have not tried. (EDIT: Legacy mode also has the same issue. So essentially only 5GHz channels will work at least for me)

Some historical comments suggest wifi performance in Openwrt is nowhere near that of stock firmware, hovering around 2xx Mbps only. And people turn to unofficial firmwares like immortalwrt because of this. I just did an iperf3 on my cellphone to my router running 23.05-rc2, and these are the results:

BL4CKR4Y · August 25, 2023, 5:27pm

anyone? ⠀ ⠀ ⠀

seemebreakthis · August 25, 2023, 5:34pm

I have wireguard server running on my router, but it is linked to a remote router and the bottleneck will definitely be the ISP linked to my remote router. So can't check for you sorry.

BL4CKR4Y · August 25, 2023, 5:50pm

and you wireguard server would have the same bandwidth or effect on the router as the wireguard client?

seemebreakthis · August 25, 2023, 5:53pm

The wireguard tunnel's bandwidth is limited by the (very slow) remote router's ISP service.

BL4CKR4Y · August 25, 2023, 6:05pm

i ment for using iperf as the bandwidth speedtest

seemebreakthis · August 25, 2023, 6:08pm

iperf3 from my wireguard client to my wireguard server: ~500kbps
iperf3 to my wireguard client from my wireguard server: ~5Mbps

Again, the internet service provider that my remote network uses is the bottleneck.

EDIT: Let me clarify further for you. These numbers are SPECIFIC to my own scenario. Totally useless to you.

BL4CKR4Y · August 25, 2023, 6:23pm

local iperf server and client doesnt rely on internet

RobertP · August 29, 2023, 6:41pm

Has anyone tested the new firmware 01890?

NoahO · September 9, 2023, 5:02am

EDIT: AX3600, wrong thread my bad!

Hey all, remoteproc crash today on fresh install of openwrt-23.05.0-rc3-ipq807x-generic-xiaomi_ax3600-squashfs-sysupgrade,

Wiped Config,
Added 2 VLANs and associated bridge devices / SSIDs
Added 1 SSID with LAN bridge (no vlan tagging)

Connected to the SSID without vlan tagging (lan)
Ran an iPerf test, performance looks great (on AC, anyway)
Connected to the SSID with vlan tagging (public)
Couldn't run iPerf, probably because the SSH session died on my other device hosting iPerf
Tried to switch back to SSID without vlan tagging (lan), instantly crashed the WLAN remoteproc

Had to remove the timestamps to make it fit, sorry!

Syslog

daemon.notice netifd: Interface 'iot' is setting up now
daemon.notice netifd: Interface 'iot' is now up
kern.info kernel: [   15.436373] IPv6: ADDRCONF(NETDEV_CHANGE): br-iot: link becomes ready
kern.info kernel: [   15.457309] IPv6: ADDRCONF(NETDEV_CHANGE): phy1-ap1: link becomes ready
daemon.notice netifd: Wireless device 'radio1' is now up
daemon.notice netifd: Network device 'phy1-ap0' link is up
daemon.notice netifd: Network device 'phy1-ap1' link is up
daemon.notice hostapd: phy1-ap0: interface state HT_SCAN->ENABLED
daemon.notice hostapd: phy1-ap0: AP-ENABLED
kern.info kernel: [   16.806577] nss-dp 3a001400.dp3 lan1: PHY Link up speed: 1000
kern.info kernel: [   16.806663] br-lan: port 1(lan1) entered blocking state
kern.info kernel: [   16.811317] br-lan: port 1(lan1) entered forwarding state
daemon.notice netifd: Network device 'lan1' link is up
kern.info kernel: [   16.816670] br-iot: port 1(lan1.66) entered blocking state
kern.info kernel: [   16.821907] br-iot: port 1(lan1.66) entered forwarding state
daemon.notice netifd: 8021q 'lan1.66' link is up
kern.info kernel: [   33.126328] l11: disabling
daemon.err uhttpd[1967]: [info] luci: accepted login on / for root from 192.168.44.191
daemon.info dnsmasq[1]: exiting on receipt of SIGTERM
daemon.info dnsmasq[1]: started, version 2.89 cachesize 1000
daemon.info dnsmasq[1]: DNS service limited to local subnets
daemon.info dnsmasq[1]: compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-nftset no-auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile
daemon.info dnsmasq[1]: UBus support enabled: connected to system bus
daemon.info dnsmasq[1]: using only locally-known addresses for test
daemon.info dnsmasq[1]: using only locally-known addresses for onion
daemon.info dnsmasq[1]: using only locally-known addresses for localhost
daemon.info dnsmasq[1]: using only locally-known addresses for local
daemon.info dnsmasq[1]: using only locally-known addresses for invalid
daemon.info dnsmasq[1]: using only locally-known addresses for bind
daemon.info dnsmasq[1]: using only locally-known addresses for lan
daemon.info dnsmasq[1]: reading /tmp/resolv.conf.d/resolv.conf.auto
daemon.info dnsmasq[1]: using nameserver 192.168.44.1#53
daemon.info dnsmasq[1]: using only locally-known addresses for test
daemon.info dnsmasq[1]: using only locally-known addresses for onion
daemon.info dnsmasq[1]: using only locally-known addresses for localhost
daemon.info dnsmasq[1]: using only locally-known addresses for local
daemon.info dnsmasq[1]: using only locally-known addresses for invalid
daemon.info dnsmasq[1]: using only locally-known addresses for bind
daemon.info dnsmasq[1]: using only locally-known addresses for lan
daemon.info dnsmasq[1]: read /etc/hosts - 12 names
daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 0 names
kern.info kernel: [   84.815748] br-public: port 1(lan1.31) entered blocking state
kern.info kernel: [   84.815791] br-public: port 1(lan1.31) entered disabled state
kern.info kernel: [   84.820812] device lan1.31 entered promiscuous mode
kern.info kernel: [   84.828391] br-public: port 1(lan1.31) entered blocking state
kern.info kernel: [   84.830905] br-public: port 1(lan1.31) entered forwarding state
daemon.notice netifd: Interface 'public' is enabled
daemon.notice netifd: bridge 'br-public' link is up
daemon.notice netifd: Interface 'public' has link connectivity
daemon.notice netifd: Interface 'public' is setting up now
daemon.notice netifd: Interface 'public' is now up
daemon.notice netifd: 8021q 'lan1.31' link is up
kern.info kernel: [   85.846377] IPv6: ADDRCONF(NETDEV_CHANGE): br-public: link becomes ready
daemon.info dnsmasq[1]: read /etc/hosts - 12 names
daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 0 names
kern.info kernel: [  114.845148] device phy1-ap1 left promiscuous mode
kern.info kernel: [  114.845303] br-iot: port 2(phy1-ap1) entered disabled state
daemon.notice hostapd: Remove interface 'phy1-ap0'
daemon.notice hostapd: phy1-ap0: interface state ENABLED->DISABLED
daemon.notice hostapd: phy1-ap1: AP-DISABLED
daemon.notice hostapd: phy1-ap1: CTRL-EVENT-TERMINATING
daemon.err hostapd: rmdir[ctrl_interface=/var/run/hostapd]: Permission denied
daemon.notice hostapd: nl80211: Failed to remove interface phy1-ap1 from bridge br-iot: No such device
daemon.notice hostapd: phy1-ap0: AP-DISABLED
daemon.notice hostapd: phy1-ap0: CTRL-EVENT-TERMINATING
daemon.err hostapd: rmdir[ctrl_interface=/var/run/hostapd]: Permission denied
daemon.notice hostapd: nl80211: deinit ifname=phy1-ap0 disabled_11b_rates=0
kern.info kernel: [  115.165178] device phy1-ap0 left promiscuous mode
kern.info kernel: [  115.165306] br-lan: port 5(phy1-ap0) entered disabled state
daemon.notice netifd: Network device 'phy1-ap0' link is down
daemon.notice netifd: Wireless device 'radio1' is now down
daemon.notice hostapd: Configuration file: /var/run/hostapd-phy1.conf (phy phy1-ap0) --> new PHY
kern.info kernel: [  115.898162] br-lan: port 5(phy1-ap0) entered blocking state
kern.info kernel: [  115.898210] br-lan: port 5(phy1-ap0) entered disabled state
kern.info kernel: [  115.902756] device phy1-ap0 entered promiscuous mode
kern.info kernel: [  115.908284] br-lan: port 5(phy1-ap0) entered blocking state
kern.info kernel: [  115.913318] br-lan: port 5(phy1-ap0) entered forwarding state
daemon.notice hostapd: phy1-ap0: interface state UNINITIALIZED->HT_SCAN
kern.info kernel: [  116.166420] br-lan: port 5(phy1-ap0) entered disabled state
kern.info kernel: [  116.332913] IPv6: ADDRCONF(NETDEV_CHANGE): phy1-ap0: link becomes ready
kern.info kernel: [  116.333155] br-lan: port 5(phy1-ap0) entered blocking state
kern.info kernel: [  116.338385] br-lan: port 5(phy1-ap0) entered forwarding state
kern.info kernel: [  116.448377] br-public: port 2(phy1-ap1) entered blocking state
kern.info kernel: [  116.448426] br-public: port 2(phy1-ap1) entered disabled state
kern.info kernel: [  116.453341] device phy1-ap1 entered promiscuous mode
kern.info kernel: [  116.460828] br-public: port 2(phy1-ap1) entered blocking state
kern.info kernel: [  116.464061] br-public: port 2(phy1-ap1) entered forwarding state
kern.info kernel: [  116.500715] IPv6: ADDRCONF(NETDEV_CHANGE): phy1-ap1: link becomes ready
daemon.notice hostapd: phy1-ap0: interface state HT_SCAN->ENABLED
daemon.notice hostapd: phy1-ap0: AP-ENABLED
daemon.notice netifd: Wireless device 'radio1' is now up
daemon.notice netifd: Network device 'phy1-ap0' link is up
daemon.notice netifd: Network device 'phy1-ap1' link is up
daemon.info dnsmasq[1]: read /etc/hosts - 12 names
daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 0 names
kern.info kernel: [  245.202386] device wan left promiscuous mode
kern.info kernel: [  245.202557] br-lan: port 4(wan) entered disabled state
kern.info kernel: [  245.249033] br-iot: port 2(wan) entered blocking state
kern.info kernel: [  245.249074] br-iot: port 2(wan) entered disabled state
kern.info kernel: [  245.253254] device wan entered promiscuous mode
daemon.info dnsmasq[1]: read /etc/hosts - 12 names
daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 0 names
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: associated (aid 1)
daemon.notice hostapd: phy1-ap0: AP-STA-CONNECTED 00:0c:29:55:53:84 auth_alg=sae
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy1-ap0: EAPOL-4WAY-HS-COMPLETED 00:0c:29:55:53:84
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd IEEE 802.11: authenticated
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd IEEE 802.11: associated (aid 1)
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd IEEE 802.11: authenticated
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd IEEE 802.11: associated (aid 1)
daemon.notice hostapd: phy1-ap1: AP-STA-CONNECTED cc:20:e8:bb:e0:cd auth_alg=open
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy1-ap1: EAPOL-4WAY-HS-COMPLETED cc:20:e8:bb:e0:cd
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f IEEE 802.11: associated (aid 2)
daemon.notice hostapd: phy1-ap1: AP-STA-CONNECTED 90:dd:5d:b8:68:7f auth_alg=sae
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy1-ap1: EAPOL-4WAY-HS-COMPLETED 90:dd:5d:b8:68:7f
daemon.notice hostapd: phy1-ap1: AP-STA-DISCONNECTED cc:20:e8:bb:e0:cd
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd IEEE 802.11: disassociated
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.notice hostapd: phy1-ap1: AP-STA-DISCONNECTED 90:dd:5d:b8:68:7f
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f IEEE 802.11: disassociated
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd IEEE 802.11: authenticated
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd IEEE 802.11: authenticated
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd IEEE 802.11: associated (aid 1)
daemon.notice hostapd: phy1-ap1: AP-STA-CONNECTED cc:20:e8:bb:e0:cd auth_alg=open
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy1-ap1: EAPOL-4WAY-HS-COMPLETED cc:20:e8:bb:e0:cd
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f IEEE 802.11: authenticated
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f IEEE 802.11: associated (aid 2)
daemon.notice hostapd: phy1-ap1: AP-STA-CONNECTED 90:dd:5d:b8:68:7f auth_alg=open
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy1-ap1: EAPOL-4WAY-HS-COMPLETED 90:dd:5d:b8:68:7f
daemon.notice hostapd: phy1-ap1: AP-STA-DISCONNECTED cc:20:e8:bb:e0:cd
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd IEEE 802.11: disassociated
daemon.info hostapd: phy1-ap1: STA cc:20:e8:bb:e0:cd IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.notice hostapd: phy1-ap1: AP-STA-DISCONNECTED 90:dd:5d:b8:68:7f
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f IEEE 802.11: disassociated
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.notice hostapd: Configuration file: /var/run/hostapd-phy2.conf (phy phy2-ap0) --> new PHY
kern.info kernel: [  720.501057] br-iot: port 3(phy2-ap0) entered blocking state
kern.info kernel: [  720.501103] br-iot: port 3(phy2-ap0) entered disabled state
kern.info kernel: [  720.505628] device phy2-ap0 entered promiscuous mode
kern.info kernel: [  720.511144] br-iot: port 3(phy2-ap0) entered blocking state
kern.info kernel: [  720.516211] br-iot: port 3(phy2-ap0) entered forwarding state
kern.info kernel: [  720.521907] br-iot: port 3(phy2-ap0) entered disabled state
kern.info kernel: [  720.672939] IPv6: ADDRCONF(NETDEV_CHANGE): phy2-ap0: link becomes ready
kern.info kernel: [  720.673139] br-iot: port 3(phy2-ap0) entered blocking state
kern.info kernel: [  720.678392] br-iot: port 3(phy2-ap0) entered forwarding state
daemon.notice hostapd: phy2-ap0: interface state UNINITIALIZED->ENABLED
daemon.notice hostapd: phy2-ap0: AP-ENABLED
daemon.notice netifd: Wireless device 'radio2' is now up
daemon.notice netifd: Network device 'phy2-ap0' link is up
daemon.info dnsmasq[1]: read /etc/hosts - 12 names
daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 0 names
daemon.info hostapd: phy1-ap1: STA aa:3b:06:1b:9f:ff IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f IEEE 802.11: authenticated
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f IEEE 802.11: associated (aid 1)
daemon.notice hostapd: phy1-ap1: AP-STA-CONNECTED 90:dd:5d:b8:68:7f auth_alg=open
daemon.info hostapd: phy1-ap1: STA 90:dd:5d:b8:68:7f WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy1-ap1: EAPOL-4WAY-HS-COMPLETED 90:dd:5d:b8:68:7f
daemon.info hostapd: phy2-ap0: STA 24:62:ab:6e:6a:e5 IEEE 802.11: authenticated
daemon.info hostapd: phy2-ap0: STA 24:62:ab:6e:6a:e5 IEEE 802.11: associated (aid 1)
daemon.notice hostapd: phy2-ap0: AP-STA-CONNECTED 24:62:ab:6e:6a:e5 auth_alg=open
daemon.info hostapd: phy2-ap0: STA 24:62:ab:6e:6a:e5 WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy2-ap0: EAPOL-4WAY-HS-COMPLETED 24:62:ab:6e:6a:e5
daemon.info hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: authenticated
daemon.info hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: associated (aid 2)
daemon.info hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: deauthenticated due to local deauth request
daemon.info hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: authenticated
daemon.notice hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: did not acknowledge authentication response
daemon.info hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: associated (aid 2)
daemon.info hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: deauthenticated due to local deauth request
daemon.notice hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: did not acknowledge authentication response
daemon.notice hostapd: phy1-ap0: AP-STA-DISCONNECTED 00:0c:29:55:53:84
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: disassociated
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.notice hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: did not acknowledge authentication response
daemon.info hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: associated (aid 2)
daemon.notice hostapd: phy2-ap0: AP-STA-CONNECTED 00:0a:f5:cc:e1:c4 auth_alg=open
daemon.info hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy2-ap0: EAPOL-4WAY-HS-COMPLETED 00:0a:f5:cc:e1:c4
daemon.info hostapd: phy1-ap1: STA aa:3b:06:1b:9f:ff IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: associated (aid 1)
daemon.notice hostapd: phy1-ap0: AP-STA-CONNECTED 00:0c:29:55:53:84 auth_alg=sae
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy1-ap0: EAPOL-4WAY-HS-COMPLETED 00:0c:29:55:53:84
authpriv.info dropbear[4699]: Child connection from 192.168.44.191:57143
authpriv.info dropbear[4699]: Exit before auth from <192.168.44.191:57143>: Exited normally
authpriv.info dropbear[4700]: Child connection from 192.168.44.191:57147
authpriv.notice dropbear[4700]: Password auth succeeded for 'root' from 192.168.44.191:57147
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: disconnected due to excessive missing ACKs
daemon.notice hostapd: phy1-ap0: AP-STA-DISCONNECTED 00:0c:29:55:53:84
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: associated (aid 1)
daemon.notice hostapd: phy1-ap0: AP-STA-CONNECTED 00:0c:29:55:53:84 auth_alg=sae
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy1-ap0: EAPOL-4WAY-HS-COMPLETED 00:0c:29:55:53:84
authpriv.info dropbear[4720]: Child connection from 192.168.44.191:57224
authpriv.notice dropbear[4720]: Password auth succeeded for 'root' from 192.168.44.191:57224
authpriv.info dropbear[4720]: TCP forward failed: Error listening: Address in use
authpriv.info dropbear[4722]: Child connection from 192.168.44.191:57231
authpriv.info dropbear[4722]: Exit before auth from <192.168.44.191:57231>: (user 'root', 0 fails): Exited normally
authpriv.info dropbear[4720]: TCP forward failed: Error listening: Address in use
authpriv.info dropbear[4723]: Child connection from 192.168.44.191:57232
authpriv.info dropbear[4723]: Exit before auth from <192.168.44.191:57232>: (user 'root', 0 fails): Exited normally
authpriv.info dropbear[4720]: TCP forward failed: Error listening: Address in use
authpriv.info dropbear[4724]: Child connection from 192.168.44.191:57233
authpriv.info dropbear[4724]: Exit before auth from <192.168.44.191:57233>: (user 'root', 0 fails): Exited normally
daemon.notice hostapd: phy2-ap0: AP-STA-POLL-OK 00:0a:f5:cc:e1:c4
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: disconnected due to excessive missing ACKs
daemon.notice hostapd: phy1-ap0: AP-STA-DISCONNECTED 00:0c:29:55:53:84
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: associated (aid 1)
daemon.notice hostapd: phy1-ap0: AP-STA-CONNECTED 00:0c:29:55:53:84 auth_alg=sae
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy1-ap0: EAPOL-4WAY-HS-COMPLETED 00:0c:29:55:53:84
daemon.notice hostapd: phy1-ap0: AP-STA-DISCONNECTED 00:0c:29:55:53:84
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: disassociated
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: associated (aid 1)
daemon.notice hostapd: phy1-ap0: AP-STA-CONNECTED 00:0c:29:55:53:84 auth_alg=sae
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy1-ap0: EAPOL-4WAY-HS-COMPLETED 00:0c:29:55:53:84
authpriv.info dropbear[4700]: Exit (root) from <192.168.44.191:57147>: Error reading: Connection reset by peer
daemon.notice hostapd: phy1-ap0: AP-STA-DISCONNECTED 00:0c:29:55:53:84
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: disassociated
daemon.info hostapd: phy1-ap1: STA 00:0c:29:55:53:84 IEEE 802.11: associated (aid 2)
daemon.notice hostapd: phy1-ap0: Prune association for 00:0c:29:55:53:84
daemon.notice hostapd: phy1-ap1: AP-STA-CONNECTED 00:0c:29:55:53:84 auth_alg=sae
daemon.info hostapd: phy1-ap1: STA 00:0c:29:55:53:84 WPA: pairwise key handshake completed (RSN)
daemon.notice hostapd: phy1-ap1: EAPOL-4WAY-HS-COMPLETED 00:0c:29:55:53:84
daemon.info hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.notice hostapd: phy2-ap0: AP-STA-DISCONNECTED 00:0a:f5:cc:e1:c4
daemon.info hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: disassociated due to inactivity
daemon.info hostapd: phy2-ap0: STA 00:0a:f5:cc:e1:c4 IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
daemon.notice hostapd: phy1-ap1: AP-STA-DISCONNECTED 00:0c:29:55:53:84
kern.err kernel: [ 1829.379014] qcom-q6v5-wcss-pil cd00000.q6v5_wcss: fatal error received:
kern.err kernel: [ 1829.379014] QC Image Version: QC_IMAGE_VERSION_STRING=WLAN.HK.2.9.0.1-01837-QCAHKSWPL_SILICONZ-1
kern.err kernel: [ 1829.379014] Image Variant : IMAGE_VARIANT_STRING=8074.wlanfw.eval_v2Q
kern.err kernel: [ 1829.379014]
kern.err kernel: [ 1829.379014] wal_peer_control.c:2904 Assertion is_graceful_to_handle failedparam0 :zero, param1 :zero, param2 :zero.
kern.err kernel: [ 1829.379014] Thread ID      : 0x00000069  Thread name    : WLAN RT0  Process ID     : 0
kern.err kernel: [ 1829.379014] Register:
kern.err kernel: [ 1829.379014] SP : 0x4bfb9340
kern.err kernel: [ 1829.379014] FP : 0x4bfb9348
kern.err kernel: [ 1829.379014] PC : 0x4b1080c4
kern.err kernel: [ 1829.379014] SSR : 0x00000008
kern.err kernel: [ 1829.379014] BADVA : 0x00020000
kern.err kernel: [ 1829.379014] LR : 0x4b107860
kern.err kernel: [ 1829.379014]
kern.err kernel: [ 1829.379014] Stack Dump
kern.err kernel: [ 1829.379014] from : 0x4bfb9340
kern.err kernel: [ 1829.379014] to   : 0x4bfb9ba0
kern.err kernel: [ 1829.379014]
kern.err kernel: [ 1829.428003] remoteproc remoteproc0: crash detected in cd00000.q6v5_wcss: type fatal error
kern.err kernel: [ 1829.450250] remoteproc remoteproc0: handling crash #1 in cd00000.q6v5_wcss
kern.err kernel: [ 1829.458474] remoteproc remoteproc0: recovering cd00000.q6v5_wcss
kern.info kernel: [ 1829.491224] remoteproc remoteproc0: stopped remote processor cd00000.q6v5_wcss
kern.warn kernel: [ 1829.796319] ath11k c000000.wifi: failed to find peer 00:0c:29:55:53:84 on vdev 0 after creation
kern.warn kernel: [ 1829.796378] ath11k c000000.wifi: failed to find peer vdev_id 0 addr 00:0c:29:55:53:84 in delete
kern.warn kernel: [ 1829.803844] ath11k c000000.wifi: failed peer 00:0c:29:55:53:84 delete vdev_id 0 fallback ret -22
kern.warn kernel: [ 1829.812549] ath11k c000000.wifi: Failed to add peer: 00:0c:29:55:53:84 for VDEV: 0
kern.warn kernel: [ 1829.821595] ath11k c000000.wifi: Failed to add station: 00:0c:29:55:53:84 for VDEV: 0
daemon.notice hostapd: phy1-ap0: STA 00:0c:29:55:53:84 IEEE 802.11: Could not add STA to kernel driver
kern.warn kernel: [ 1829.886667] ath11k c000000.wifi: failed to update rx tid queue, tid 0 (-108)
kern.warn kernel: [ 1829.886701] ath11k c000000.wifi: failed to update reo for rx tid 0: -108
kern.info kernel: [ 1829.892782] phy1-ap1: HW problem - can not stop rx aggregation for 00:0c:29:55:53:84 tid 0
kern.warn kernel: [ 1829.899493] ath11k c000000.wifi: failed to update rx tid queue, tid 0 (-108)
kern.warn kernel: [ 1829.907552] ath11k c000000.wifi: failed to update reo for rx tid 1: -108
kern.info kernel: [ 1829.914741] phy1-ap1: HW problem - can not stop rx aggregation for 00:0c:29:55:53:84 tid 1
kern.warn kernel: [ 1829.921442] ath11k c000000.wifi: failed to update rx tid queue, tid 0 (-108)
kern.info kernel: [ 1829.929510] phy1-ap1: HW problem - can not stop rx aggregation for 00:0c:29:55:53:84 tid 6
kern.warn kernel: [ 1829.976408] ------------[ cut here ]------------
kern.warn kernel: [ 1829.976430] WARNING: CPU: 1 PID: 1674 at 0xffffffc000a8aa70 [mac80211@000000000e243fd5+0x85000]
kern.warn kernel: [ 1829.980087] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_ipv6 nf_flow_table_ipv4 nf_flow_table_inet ath11k_ahb ath11k ath10k_pci ath10k_core ath pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_objref nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_counter nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack mac80211 cfg80211 slhc qrtr_smd qrtr qmi_helpers nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c crc_ccitt compat sha512_generic seqiv jitterentropy_rng drbg michael_mic hmac cmac leds_gpio xhci_plat_hcd xhci_pci xhci_hcd dwc3 dwc3_qcom qca_nss_dp qca_ssdk gpio_button_hotplug ext4 mbcache jbd2 aquantia hwmon crc32c_generic
kern.warn kernel: [ 1830.038143] CPU: 1 PID: 1674 Comm: hostapd Not tainted 5.15.127 #0
kern.warn kernel: [ 1830.060377] Hardware name: Xiaomi AX3600 (DT)
kern.warn kernel: [ 1830.066626] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
kern.warn kernel: [ 1830.071056] pc : 0xffffffc000a8aa70 [mac80211@000000000e243fd5+0x85000]
kern.warn kernel: [ 1830.077826] lr : 0xffffffc000a8aa6c [mac80211@000000000e243fd5+0x85000]
kern.warn kernel: [ 1830.084424] sp : ffffffc00bdf3840
kern.warn kernel: [ 1830.091014] x29: ffffffc00bdf3840 x28: ffffff8002c12340 x27: ffffffc00bdf3dd0
kern.warn kernel: [ 1830.094494] x26: ffffff8001c76080 x25: ffffffc008b760c0 x24: ffffffc000a7b000
kern.warn kernel: [ 1830.101611] x23: ffffffc00bdf3a38 x22: ffffff800ee60900 x21: ffffff800419eaa8
kern.warn kernel: [ 1830.108731] x20: ffffff8005c38880 x19: ffffff800419e000 x18: 0000000000000000
kern.warn kernel: [ 1830.115848] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
kern.warn kernel: [ 1830.122966] x14: 000000000000038d x13: 0000000000000000 x12: 0000000000000006
kern.warn kernel: [ 1830.130084] x11: ffffffc008989600 x10: 0000000000000000 x9 : ffffffc017528000
kern.warn kernel: [ 1830.137202] x8 : fffffffe003bf508 x7 : fffffffe003bf500 x6 : 0000000000000004
kern.warn kernel: [ 1830.144320] x5 : ffffff801feb14a0 x4 : 0000000000000000 x3 : ffffff8002c12340
kern.warn kernel: [ 1830.151438] x2 : 0000000000000000 x1 : ffffff8002c12340 x0 : 00000000ffffff94
kern.warn kernel: [ 1830.158558] Call trace:
kern.warn kernel: [ 1830.165665]  0xffffffc000a8aa70 [mac80211@000000000e243fd5+0x85000]
kern.warn kernel: [ 1830.167930]  0xffffffc000a8ad34 [mac80211@000000000e243fd5+0x85000]
kern.warn kernel: [ 1830.174180]  0xffffffc000aa323c [mac80211@000000000e243fd5+0x85000]
kern.warn kernel: [ 1830.180430]  0xffffffc000a4b1b8 [cfg80211@0000000055cc2e04+0x45000]
kern.warn kernel: [ 1830.186679]  0xffffffc00863ee7c
kern.warn kernel: [ 1830.192924]  0xffffffc00863f308
kern.warn kernel: [ 1830.196048]  0xffffffc00863df1c
kern.warn kernel: [ 1830.199173]  0xffffffc00863e788
kern.warn kernel: [ 1830.202299]  0xffffffc00863d6b8
kern.warn kernel: [ 1830.205423]  0xffffffc00863d954
kern.warn kernel: [ 1830.208547]  0xffffffc00859b1c8
kern.warn kernel: [ 1830.211673]  0xffffffc00859dba8
kern.warn kernel: [ 1830.214798]  0xffffffc00859dcf8
kern.warn kernel: [ 1830.217923]  0xffffffc00859dd84
kern.warn kernel: [ 1830.221048]  0xffffffc0080230ac
kern.warn kernel: [ 1830.224173]  0xffffffc0080231c0
kern.warn kernel: [ 1830.227297]  0xffffffc0087917b8
kern.warn kernel: [ 1830.230424]  0xffffffc0087924a8
kern.warn kernel: [ 1830.233548]  0xffffffc0080115f4
kern.warn kernel: [ 1830.236674] ---[ end trace cf19a32ce9baa54c ]---
daemon.info hostapd: phy1-ap1: STA 00:0c:29:55:53:84 IEEE 802.11: deauthenticated due to local deauth request
kern.err kernel: [ 1834.806314] qcom-q6v5-wcss-pil cd00000.q6v5_wcss: start timed out
kern.err kernel: [ 1834.806365] remoteproc remoteproc0: can't start rproc cd00000.q6v5_wcss: -110
kern.warn kernel: [ 1837.979619] ath11k_warn: 64 callbacks suppressed
kern.warn kernel: [ 1837.979638] ath11k c000000.wifi: failed to send WMI_PDEV_BSS_CHAN_INFO_REQUEST cmd
kern.warn kernel: [ 1837.983329] ath11k c000000.wifi: failed to send pdev bss chan info request
kern.warn kernel: [ 1837.990964] ath11k c000000.wifi: failed to send WMI_PDEV_SET_PARAM cmd
kern.warn kernel: [ 1837.997582] ath11k c000000.wifi: Failed to set beacon mode for VDEV: 2
kern.warn kernel: [ 1838.004090] ath11k c000000.wifi: failed to send WMI_BCN_TMPL_CMDID
kern.warn kernel: [ 1838.010597] ath11k c000000.wifi: failed to submit beacon template command: -108
kern.warn kernel: [ 1838.016765] ath11k c000000.wifi: failed to update bcn template: -108
kern.warn kernel: [ 1838.023954] ath11k c000000.wifi: failed to send WMI_VDEV_SET_PARAM_CMDID
kern.warn kernel: [ 1838.030564] ath11k c000000.wifi: failed to set BA BUFFER SIZE 256 for vdev: 2
kern.warn kernel: [ 1838.037247] ath11k c000000.wifi: failed to send WMI_VDEV_SET_PARAM_CMDID