OpenWrt support for Xiaomi AX9000

Are you sure that your grandma can't fly? What if you take her to the edge of the ledge and tell her to flap her arms? Just push, if she won't try it on her own...

Legal penalties apply.

3 Likes

Good joke slh :slight_smile:
Looks like my innocent question if anyone tried caused your allergic reaction - ridiculous absurdum comes to mind :slight_smile:
Can I return a favour and ask how big is your commission or monthly/annual salary from QCN (or similar vendor provider)?
BTW - my question is rhetorical - don't feel any obligation to answer it

Even if you turn on WiFi at 6GHz, you will not benefit from it because the FEMs used are for a frequency in the 4.9-5.9GHz range: https://www.qorvo.com/products/p/QPF4588#parameters

Thanks lytr - I appreciate constructive answer
What controls available frequencies? Isn't it the board file + regdb?

Yes, all of them.

So with this BIG assumption that board_id override will enable 6GHz on the hardware, maybe it is worth repeating the question if anyone tried?
slh: waiting for another joke (no offence taken by me)

I have an Xiaomi AX9000 international device. firmware 3.0.40_int.
I have uart and shell.
However, whenever i try to do the sysupgrade. i have an endless loop.

Flashing goes like this.

root@OpenWrt:/etc/config# sysupgrade -F -n /tmp/openwrt-qualcommax-ipq807x-xiaom
i_ax9000-squashfs-sysupgrade.bin
Sat Jan 14 15:57:35 UTC 2023 upgrade: The device is supported, but this image is incompatible for sysupgrade based on the image version (2.0->1.0).
Image check failed but --force given - will update anyway!
Sat Jan 14 15:57:35 UTC 2023 upgrade: Commencing upgrade. Closing all shell sessions.
Watchdog handover: fd=3
- watchdog -
Watchdog did not previously reset the system
Sat Jan 14 15:57:35 UTC 2023 upgrade: Sending TERM to remaining processes ...
Sat Jan 14 15:57:39 UTC 2023 upgrade: Sending KILL to remaining processes ...
[  763.877647] stage2 (3909): drop_caches: 3
ubidetach: error!: cannot detach mtd21
           error 19 (No such device)
ubiformat: mtd21 (nand), size 191365120 bytes (182.5 MiB), 1460 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 1459 -- 100 % complete
ubiformat: 1460 eraseblocks have valid erase counter, mean value is 7
ubiformat: formatting eraseblock 1459 -- 100 % complete
ubidetach: error!: cannot detach mtd20
           error 19 (No such device)
ubiformat: mtd20 (nand), size 58720256 bytes (56.0 MiB), 448 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 447 -- 100 % complete
ubiformat: 448 eraseblocks have valid erase counter, mean value is 8
ubiformat: formatting eraseblock 447 -- 100 % complete
Sat Jan 14 15:58:03 UTC 2023 upgrade: Switching to ramdisk...
Sat Jan 14 15:58:04 UTC 2023 upgrade: Performing system upgrade...
verifying sysupgrade tar file integrity
[  783.219509] ubi0: attaching mtd20
[  783.469639] ubi0: scanning is finished
[  783.475346] ubi0: attached mtd20 (name "ubi_kernel", size 56 MiB)
[  783.475381] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[  783.480420] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[  783.487204] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[  783.494054] ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
[  783.500817] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[  783.507077] ubi0: max/mean erase counter: 14/9, WL threshold: 4096, image sequence number: 1998804578
[  783.514125] ubi0: available PEBs: 404, total reserved PEBs: 44, PEBs reserved for bad PEB handling: 40
[  783.523406] ubi0: background thread "ubi_bgt0d" started, PID 4627
UBI device number 0, total 448 LEBs (56885248 bytes, 54.2 MiB), available 404 LEBs (51298304 bytes, 48.9 MiB), LEB size 126976 bytes (124.0 KiB)
[  783.559312] ubi1: attaching mtd21
[  784.383112] ubi1: scanning is finished
[  784.389712] ubi1: attached mtd21 (name "rootfs", size 182 MiB)
[  784.389751] ubi1: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[  784.394455] ubi1: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[  784.401302] ubi1: VID header offset: 2048 (aligned 2048), data offset: 4096
[  784.408164] ubi1: good PEBs: 1460, bad PEBs: 0, corrupted PEBs: 0
[  784.414932] ubi1: user volume: 0, internal volumes: 1, max. volumes count: 128
[  784.421181] ubi1: max/mean erase counter: 12/8, WL threshold: 4096, image sequence number: 1297871464
[  784.428307] ubi1: available PEBs: 1416, total reserved PEBs: 44, PEBs reserved for bad PEB handling: 40
[  784.437607] ubi1: background thread "ubi_bgt1d" started, PID 4651
UBI device number 1, total 1460 LEBs (185384960 bytes, 176.7 MiB), available 1416 LEBs (179798016 bytes, 171.4 MiB), LEB size 126976 bytes (124.0 KiB)
Volume ID 0, size 44 LEBs (5586944 bytes, 5.3 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
Volume ID 0, size 74 LEBs (9396224 bytes, 8.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 170401792
Volume ID 1, size 1342 LEBs (170401792 bytes, 162.5 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy

Whatever guide i follow, it never seem to work.

Anyone have any tips?

This is what happens during boot.

MMC Device 0 not found
bootwait is on, bootdelay=5
Hit any key to stop autoboot:  0
 trigger button release!
secure boot fuse is enabled
boot from rootfs 0
  miwifi: check crash in rmem !
ubi0: attaching mtd1
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=0", size 56 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 14/9, WL threshold: 4096, image sequence number: 1998804578
ubi0: available PEBs: 360, total reserved PEBs: 88, PEBs reserved for bad PEB handling: 40
Read 0 bytes from volume kernel to 42000000
No size specified -> Using max size (5586944)
Kernel image authentication failed
Erasing NAND...
Erasing at 0xd60000 -- 100% complete.
Writing to NAND... OK
resetting ...

That is NOT the flashing procedure documented and required for this device, please read the device page on the wiki.

I followed this: OpenWrt support for Xiaomi AX9000 - #1123 by dpeti

But you are saying this is not the way to do it on my version??

There is a procedure described on the device page... The post you linked is probably not updated by its author after some changes has been made for this device.

https://openwrt.org/toh/xiaomi/ax9000#flash_layout_in_oem_firmware

The one for the international model links to the link i sent.
Other then that there is information on how to obtain root access and ssh. (which i do have, and is not the problem)

Am i missing something? (i have checked the wiki pages numerous times)

The error you are getting refers to the secure boot. Look for ATF setting :wink:

Hi, has anyone been able to setup tagged VLAN on AX9000? I've never used it before, but bought a Netgear switch (GS308EP) that supports 802.1Q and can't get it to work. I'm running Openwrt 23.05.4. This is my relevant part of /etc/config/network:

config device
        option name 'br-lan'
        option type 'bridge'
        option igmp_snooping '1'
        list ports 'lan1'
        list ports 'lan3.13'

config device
        option type 'bridge'
        option name 'sip-lan'
        option mtu '1500'
        list ports 'lan2'
        list ports 'lan3.14'

config device
        option type 'bridge'
        option name 'br-lan_vpn'
        option ipv6 '1'
        list ports 'lan3.15'
        list ports 'lan4'

config device
        option type '8021q'
        option ifname 'lan3'
        option vid '13'
        option name 'lan3.13'

config device
        option type '8021q'
        option ifname 'lan3'
        option vid '14'
        option name 'lan3.14'

config device
        option type '8021q'
        option ifname 'lan3'
        option vid '15'
        option name 'lan3.15'

And here's VLAN config on the switch:

image

Port 1 of the switch is connected to lan4 on the router, and port 2 is connected to lan3.

As a result devices connected to ports 3-8 of the switch don't receive IP addresses via DHCP.

I've never setup tagged VLAN before, so unsure if the config is messed up, or AX9000 just doesn't support 802.1Q.

Thank you!

I can confirm that VLANs work on AX9000
I have 6 VLANs going through one interface.
Although I couldn't configure vlans via bridge vlan filtering, but maybe that was me issue.
I added multiple 8021q interfaces, just as you seem to do.
Don't forget to add relevant interfaces and create firewall zones for them, add listen interfaces to "DHCP and DNS".
OpenWRT still confuses me sometimes, but it's great!

1 Like

Thanks!

ATF was infact the missing thing!

"setenv atf 1" in u-boot if anyone is having the same problem.

Thank you! Your reply inspired me to experiment more, and it indeed works. The issue with my latest config I guess is a lan loop due to switch port 1 connected to lan_vpn directly (router port lan4). I tried without it before, but couldn't get to switch webui config (it wasn't seen in DHCP leases, nor did a static DHCP link work). So I had to give it a static IP first via the switch webui, remove the link switch port1<->router lan4, and it actually works! I just thought it didn't due to a buggy Linux Ethernet driver that failed to get IP from DHCP when connected via tagged VLAN over the switch (it turned out it works on Windows). So I broke the loop, moved my laptop Ethernet connection directly to the router, rebooted the router (looks like it's needed, didn't work otherwise), and now all's good.

I just flashed my Chinese version AX9000 to OpenWRT. Everything is working well except for the known issue with the lower 5 GHz band radio (QCN9024), caused by the BDF, that SSID is unable to connect, as described here: https://openwrt.org/toh/xiaomi/ax9000#potential_issueslimitations

  • However, the textbin link is now unavailable. Could someone share those command to generate a new BDF file, board-2.bin, compressed in the workaround?

hi, what model of ttl uart usb did you used?, didn't connect the voltage pin, so I assume it's not necessary? It happens that I have a USB UART but 3.3V or 5V, but if it's not connected, it's not necessary?. thanks

This

https://amzn.eu/d/f7hgPP2

1 Like

Hi, I shared the archive here: OpenWrt support for Xiaomi AX9000 - #1866 by alllexx88
However I find that board-2.bin from this post works better, even NSS (160MHz) works: OpenWrt support for Xiaomi AX9000 - #1798 by Soromeister

1 Like