I see ... so we won't get 6Ghz working on ax9000 right?
Yes, that is correct
Are you using qualcommax/ipq807x or ipq807x/generic ? I'm currently on ipq807x/generic with 23.05.0 . I'm confused...
With that version I got a reproducible error that cannot be recovered without reboot on QCN6024/9024/9074 . If a client tries to connect with a wrong key and keeps repeating it will give a kernel error after an hour or so.
Hi everyone!
I just wanted to confirm if the UART method is still the only method to flash the Mi Router AX9000 Global version. If it is, is there a timeline to provide support for the ubiformat flashing?
Thanks in advance 
I might be wrong, but as far as I'm aware there isn't any timeline
Xiaomi decided to make it difficult to replace their international software - luckily for us they didn't lock down the UART route. But without Xiaomi help this seems like not achievable task.
Slightly off topic, but i wonder whether dawn or usteer is the better option for AX9000...
One thing for certain, both works. I am using dawn. You are using usteer. Both of us are happy with our setup, band steering and all.
i tried to boot into u-boot, but not successful, could anyone tell me how to do it. my serial connections worked and i have an international ax9000.
any help please
my serial output is here
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B - 201 - PBL, Start
B - 2735 - bootable_media_detect_entry, Start
B - 3441 - bootable_media_detect_success, Start
B - 3445 - elf_loader_entry, Start
B - 6107 - auth_hash_seg_entry, Start
B - 43640 - auth_hash_seg_exit, Start
B - 105465 - elf_segs_hash_verify_entry, Start
B - 168321 - PBL, End
B - 184921 - SBL1, Start
B - 238357 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B - 245006 - pm_device_init, Start
B - 369416 - PM_SET_VAL:Skip
D - 123860 - pm_device_init, Delta
B - 371825 - pm_driver_init, Start
D - 5337 - pm_driver_init, Delta
B - 378139 - clock_init, Start
D - 2104 - clock_init, Delta
B - 382165 - boot_flash_init, Start
D - 12505 - boot_flash_init, Delta
B - 398452 - boot_config_data_table_init, Start
D - 3080 - boot_config_data_table_init, Delta - (575 Bytes)
B - 405924 - Boot Setting : 0x00000600
B - 409859 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:18
B - 416874 - sbl1_ddr_set_params, Start
B - 420686 - CPR configuration: 0x300
B - 424072 - cpr_init, Start
B - 426939 - Rail:0 Mode: 5 Voltage: 816000
B - 432032 - CL CPR settled at 768000mV
B - 434960 - Rail:1 Mode: 5 Voltage: 880000
B - 439139 - Rail:1 Mode: 7 Voltage: 920000
D - 16470 - cpr_init, Delta
B - 446001 - Pre_DDR_clock_init, Start
B - 449997 - Pre_DDR_clock_init, End
B - 453413 - DDR Type : PCDDR3
B - 459055 - do ddr sanity test, Start
D - 1037 - do ddr sanity test, Delta
B - 463905 - DDR: Start of HAL DDR Boot Training
B - 468541 - DDR: End of HAL DDR Boot Training
B - 474214 - DDR: Checksum to be stored on flash is 1745644481
B - 484645 - Image Load, Start
D - 506910 - QSEE Image Loaded, Delta - (1381328 Bytes)
B - 991646 - Image Load, Start
D - 61 - SEC Image Loaded, Delta - (0 Bytes)
B - 999302 - Image Load, Start
D - 293776 - DEVCFG Image Loaded, Delta - (32548 Bytes)
B - 1293169 - Image Load, Start
D - 305031 - RPM Image Loaded, Delta - (93060 Bytes)
B - 1598261 - Image Load, Start
D - 376980 - APPSBL Image Loaded, Delta - (583214 Bytes)
B - 1975363 - QSEE Execution, Start
D - 61 - QSEE Execution, Delta
B - 1981158 - USB D+ check, Start
D - 0 - USB D+ check, Delta
B - 1987563 - SBL1, End
D - 1804929 - SBL1, Delta
S - Flash Throughput, 6733 KB/s (2091397 Bytes, 310575 us)
S - DDR Frequency, 466 MHz
S - Core 0 Frequency, 1651 MHz
U-Boot 2016.01 (Mar 22 2022 - 03:16:43 +0000), Build: jenkins-common_router_openwrt_ota_publish-2761
DRAM: smem ram ptable found: ver: 1 len: 4
1 GiB
NAND: Could not find nand_gpio in dts, using defaults
ONFI device found
ID = 1590aaef
Vendor = ef
Device = aa
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC: sdhci: Node Not found, skipping initialization
Error: flags type check failure for "ethaddr" <= ""00:AA:BB:CC:DD:10"" (type: m)
himport_r: can't insert "ethaddr="00:AA:BB:CC:DD:10"" into hash table
PCI Link Intialized
PCI Link Intialized
In: serial@78B3000
Out: serial@78B3000
Err: serial@78B3000
machid: 8010012
MMC Device 0 not found
bootwait is off, bootdelay=5
Hit any key to stop autoboot: 0
trigger button release!
secure boot fuse is enabled
boot from rootfs 0
miwifi: check crash in rmem !
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 56 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 4/0, WL threshold: 4096, image sequence number: 1963820375
ubi0: available PEBs: 0, total reserved PEBs: 448, PEBs reserved for bad PEB handling: 40
Read 0 bytes from volume kernel to 42000000
No size specified -> Using max size (6221824)
Read 0 bytes from volume ubi_rootfs to 44000028
No size specified -> Using max size (33648640)
Loading kernel from FIT Image at 42000028 ...
Using 'config@hk14' configuration
Trying 'kernel@1' kernel subimage
Do you mind posting here your full down config?
This way people could decide for themself which tool is easier to set-up?
using uart openwrt install but when i install sysupgrade my router into bootloop.
my logs are..
restore_defaults is set, enlarge xqup detect time
trigger button release!
secure boot fuse is enabled
boot from rootfs 0
miwifi: check crash in rmem !
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 56 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 16/11, WL threshold: 4096, image sequence number: 1460717228
ubi0: available PEBs: 404, total reserved PEBs: 44, PEBs reserved for bad PEB handling: 40
Read 0 bytes from volume kernel to 42000000
Volume kernel not found!
ubi0: detaching mtd1
ubi0: mtd1 is detached
Erasing NAND...
Erasing at 0xd00000 -- 25% complete.
Erasing at 0xd20000 -- 50% complete.
Erasing at 0xd40000 -- 75% complete.
Erasing at 0xd60000 -- 100% complete.
Writing to NAND... OK
resetting ...
.
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B - 201 - PBL, Start
B - 2736 - bootable_media_detect_entry, Start
B - 3443 - bootable_media_detect_success, Start
B - 3448 - elf_loader_entry, Start
B - 6112 - auth_hash_seg_entry, Start
B - 43683 - auth_hash_seg_exit, Start
B - 105585 - elf_segs_hash_verify_entry, Start
B - 168443 - PBL, End
B - 278343 - SBL1, Start
B - 358649 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B - 368684 - pm_device_init, Start
B - 555435 - PM_SET_VAL:Skip
D - 184769 - pm_device_init, Delta
B - 557875 - pm_driver_init, Start
D - 5398 - pm_driver_init, Delta
B - 564158 - clock_init, Start
D - 2104 - clock_init, Delta
B - 568184 - boot_flash_init, Start
D - 12505 - boot_flash_init, Delta
B - 584471 - boot_config_data_table_init, Start
D - 3080 - boot_config_data_table_init, Delta - (575 Bytes)
B - 591944 - Boot Setting : 0x00000600
B - 595878 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:18
B - 602893 - sbl1_ddr_set_params, Start
B - 606706 - CPR configuration: 0x300
B - 610091 - cpr_init, Start
B - 612958 - Rail:0 Mode: 5 Voltage: 816000
B - 618052 - CL CPR settled at 768000mV
B - 620980 - Rail:1 Mode: 5 Voltage: 880000
B - 625158 - Rail:1 Mode: 7 Voltage: 920000
D - 16470 - cpr_init, Delta
B - 632021 - Pre_DDR_clock_init, Start
B - 636047 - Pre_DDR_clock_init, End
B - 639341 - DDR Type : PCDDR3
B - 645075 - do ddr sanity test, Start
D - 1067 - do ddr sanity test, Delta
B - 649924 - DDR: Start of HAL DDR Boot Training
B - 654560 - DDR: End of HAL DDR Boot Training
B - 660264 - DDR: Checksum to be stored on flash is 1745644481
B - 670695 - Image Load, Start
D - 507063 - QSEE Image Loaded, Delta - (1381328 Bytes)
B - 1177818 - Image Load, Start
D - 91 - SEC Image Loaded, Delta - (0 Bytes)
B - 1185504 - Image Load, Start
D - 293746 - DEVCFG Image Loaded, Delta - (32548 Bytes)
B - 1479341 - Image Load, Start
D - 305031 - RPM Image Loaded, Delta - (93060 Bytes)
B - 1784433 - Image Load, Start
D - 377010 - APPSBL Image Loaded, Delta - (583214 Bytes)
B - 2161565 - QSEE Execution, Start
D - 61 - QSEE Execution, Delta
B - 2167360 - USB D+ check, Start
D - 30 - USB D+ check, Delta
B - 2173765 - SBL1, End
D - 1897710 - SBL1, Delta
S - Flash Throughput, 6728 KB/s (2091397 Bytes, 310818 us)
S - DDR Frequency, 466 MHz
S - Core 0 Frequency, 1651 MHz
U-Boot 2016.01 (Mar 22 2022 - 03:16:43 +0000), Build: jenkins-common_router_openwrt_ota_publish-2761
DRAM: smem ram ptable found: ver: 1 len: 4
1 GiB
NAND: Could not find nand_gpio in dts, using defaults
ONFI device found
ID = 1590aaef
Vendor = ef
Device = aa
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC: sdhci: Node Not found, skipping initialization
PCI Link Intialized
PCI Link Intialized
In: serial@78B3000
Out: serial@78B3000
Err: serial@78B3000
machid: 8010012
MMC Device 0 not found
bootwait is on, bootdelay=5
Hit any key to stop autoboot: 5 ... 4 ... 3 ... 2
i try to install via your way.. once openwrt booted ssh in to openwrt and sysupgrade and it stuck in bootloop...
what am i doing wrong ??
trigger button release!
secure boot fuse is enabled
boot from rootfs 0
miwifi: check crash in rmem !
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 56 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 16/11, WL threshold: 4096, image sequence number: 1460717228
ubi0: available PEBs: 404, total reserved PEBs: 44, PEBs reserved for bad PEB handling: 40
Read 0 bytes from volume kernel to 42000000
Volume kernel not found!
ubi0: detaching mtd1
ubi0: mtd1 is detached
Erasing NAND...
Erasing at 0xd00000 -- 25% complete.
Erasing at 0xd20000 -- 50% complete.
Erasing at 0xd40000 -- 75% complete.
Erasing at 0xd60000 -- 100% complete.
Writing to NAND... OK
resetting ...
.
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B - 201 - PBL, Start
B - 2736 - bootable_media_detect_entry, Start
B - 3443 - bootable_media_detect_success, Start
B - 3448 - elf_loader_entry, Start
B - 6112 - auth_hash_seg_entry, Start
B - 43683 - auth_hash_seg_exit, Start
B - 105585 - elf_segs_hash_verify_entry, Start
B - 168443 - PBL, End
B - 278343 - SBL1, Start
B - 358649 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B - 368684 - pm_device_init, Start
B - 555435 - PM_SET_VAL:Skip
D - 184769 - pm_device_init, Delta
B - 557875 - pm_driver_init, Start
D - 5398 - pm_driver_init, Delta
B - 564158 - clock_init, Start
D - 2104 - clock_init, Delta
B - 568184 - boot_flash_init, Start
D - 12505 - boot_flash_init, Delta
B - 584471 - boot_config_data_table_init, Start
D - 3080 - boot_config_data_table_init, Delta - (575 Bytes)
B - 591944 - Boot Setting : 0x00000600
B - 595878 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:18
B - 602893 - sbl1_ddr_set_params, Start
B - 606706 - CPR configuration: 0x300
B - 610091 - cpr_init, Start
B - 612958 - Rail:0 Mode: 5 Voltage: 816000
B - 618052 - CL CPR settled at 768000mV
B - 620980 - Rail:1 Mode: 5 Voltage: 880000
B - 625158 - Rail:1 Mode: 7 Voltage: 920000
D - 16470 - cpr_init, Delta
B - 632021 - Pre_DDR_clock_init, Start
B - 636047 - Pre_DDR_clock_init, End
B - 639341 - DDR Type : PCDDR3
B - 645075 - do ddr sanity test, Start
D - 1067 - do ddr sanity test, Delta
B - 649924 - DDR: Start of HAL DDR Boot Training
B - 654560 - DDR: End of HAL DDR Boot Training
B - 660264 - DDR: Checksum to be stored on flash is 1745644481
B - 670695 - Image Load, Start
D - 507063 - QSEE Image Loaded, Delta - (1381328 Bytes)
B - 1177818 - Image Load, Start
D - 91 - SEC Image Loaded, Delta - (0 Bytes)
B - 1185504 - Image Load, Start
D - 293746 - DEVCFG Image Loaded, Delta - (32548 Bytes)
B - 1479341 - Image Load, Start
D - 305031 - RPM Image Loaded, Delta - (93060 Bytes)
B - 1784433 - Image Load, Start
D - 377010 - APPSBL Image Loaded, Delta - (583214 Bytes)
B - 2161565 - QSEE Execution, Start
D - 61 - QSEE Execution, Delta
B - 2167360 - USB D+ check, Start
D - 30 - USB D+ check, Delta
B - 2173765 - SBL1, End
D - 1897710 - SBL1, Delta
S - Flash Throughput, 6728 KB/s (2091397 Bytes, 310818 us)
S - DDR Frequency, 466 MHz
S - Core 0 Frequency, 1651 MHz
U-Boot 2016.01 (Mar 22 2022 - 03:16:43 +0000), Build: jenkins-common_router_openwrt_ota_publish-2761
DRAM: smem ram ptable found: ver: 1 len: 4
1 GiB
NAND: Could not find nand_gpio in dts, using defaults
ONFI device found
ID = 1590aaef
Vendor = ef
Device = aa
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC: sdhci: Node Not found, skipping initialization
PCI Link Intialized
PCI Link Intialized
In: serial@78B3000
Out: serial@78B3000
Err: serial@78B3000
machid: 8010012
MMC Device 0 not found
bootwait is on, bootdelay=5
Hit any key to stop autoboot: 5 ... 4 ... 3 ... 2
Which image did you use ?
Than upgrade to sysudate
atf 1 has been set ?
How its been set?
Sure thing, here is the dawn config. My routers have been up for 45+ days, basically since all the config tweaks have completed, and no issues with dawn.
Would be nice if you could let me know your usteer config also. One day I might try just to see what the differences are if any... thank you !
config local
option loglevel '5'
config network
option broadcast_ip '192.168.1.255'
option broadcast_port '1025'
option tcp_port '1026'
option network_option '2'
option shared_key 'Niiiiiiiiiiiiick'
option iv 'Niiiiiiiiiiiiick'
option use_symm_enc '0'
option collision_domain '-1'
option bandwidth '-1'
config hostapd
option hostapd_dir '/var/run/hostapd'
config times
option con_timeout '60'
option update_client '10'
option remove_client '15'
option remove_probe '30'
option remove_ap '460'
option update_hostapd '10'
option update_tcp_con '10'
option update_chan_util '5'
option update_beacon_reports '20'
config metric 'global'
option min_probe_count '0'
option bandwidth_threshold '0'
option use_station_count '0'
option max_station_diff '1'
option eval_probe_req '0'
option eval_auth_req '0'
option eval_assoc_req '0'
option kicking '1'
option kicking_threshold '40'
option deny_auth_reason '1'
option deny_assoc_reason '17'
option min_number_to_kick '2'
option chan_util_avg_period '3'
option set_hostapd_nr '1'
option duration '200'
option rrm_mode 'apt'
config metric '802_11g'
option initial_score '200'
option ht_support '0'
option vht_support '0'
option no_ht_support '0'
option no_vht_support '0'
option rssi '0'
option rssi_val '-10'
option low_rssi_val '-50'
option low_rssi '0'
option chan_util '0'
option chan_util_val '140'
option max_chan_util '0'
option max_chan_util_val '170'
option rssi_weight '4'
option rssi_center '-25'
config metric '802_11a'
option initial_score '80'
option ht_support '0'
option vht_support '0'
option no_ht_support '0'
option no_vht_support '0'
option rssi '0'
option rssi_val '-10'
option low_rssi_val '-65'
option low_rssi '0'
option chan_util '0'
option chan_util_val '140'
option max_chan_util '0'
option max_chan_util_val '170'
option rssi_weight '8'
option rssi_center '-65'
1 Like
too many tries still after sysupgrade to openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade.bin into boot loop...
what is missing here...
i started from u-boot
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.100
tftpboot 0x44000000 openwrt-23.05.0-ipq807x-generic-xiaomi_ax9000-initramfs-uImage.itb
bootm
than openwrt booted from ram, I think..
tried this as well
uci set system.@system[0].compat_version="1.0"
uci commit system
than upgrade to openwrt-ipq807x-generic-xiaomi_ax9000-squashfs-sysupgrade
still in boot loop.....
anyone tell me what is wrong in this process.. i have international version ax9000
resolved...
fw_setenv atf 1
2 Likes
Hello everyone !
I try to root my AX9000 to install OpenWRT. I am a International firmware rev 3.0.48
I use the first method, the "Direct rooting device" available here : https://openwrt.org/toh/xiaomi/ax9000#direct_rooting_device_procedure
I've use the script in console and I've obtained the 3 files (1.bin to 3.bin). But when I tried to upload them on my AX9000 via the "update manually" button, I've this message error in a popup : "Couldn't verify file".
has anyone ever faced this problem? Did I do something wrong?
Thanks for the help !
You need to use internatioanl version specific exploit script.
OpenWrt support for Xiaomi AX9000 - For Developers - OpenWrt Forum