I followed this tutorial, and I entered these commands in PuTTY: nvram set uart_en=1 nvram set boot_wait=on nvram commit Then I installed Tera Term and it gets stuck in a loop. I disabled the antivirus, my current firmware is 3.0.40, and I later set my PC's IP to 192.168.1.100. I can’t get out of the loop. Any help, please
Check the tftp server settings thorougly, also check that you use the LAN1 port in xiaomi.
is ax9000 in config or ax6000?
In "make menuconfig" AX9000:
Target System (Qualcomm Atheros 802.11ax WiSoC-s) --->
Subtarget (Qualcomm Atheros IPQ807x) --->
Target Profile (Xiaomi AX9000) --->
it is ax9000
Thank you, and also thank you
1 Like
Hi,:
I've installed both packages and the needed luci-compat but the fan-control ist not working. It shows always inactive.
I've enabled/disabled it and did a restart. Still the same.. do you have an idea?
Best
Edit:
My mistake, I haven't read that I need to install some other packages to get the hardware to work. Now I cannot install kmod-hwmon-emc2305 because it's not in my openwrt installation, seems the kernel is to old.
Yeap you need to upgrade to 24.10
I did the update to 24.10, installed these missed packages and it works now, thanks.
Hi All,
WiFi on radio3 (QCN9024) won't start.
I have only one error during restart radio:
daemon.err hostapd: rmdir[ctrl_interface=/var/run/hostapd]: Permission denied
Any tip how to wake up?
I did some settings, but without luck.
how i get ssh, for installing???
It's mentioned in this topic if you use search:
Read wiki.
Problem Flashing OpenWrt on Xiaomi AX9000 (Global 3.0.40)
Hello everyone,
I'm trying to install OpenWrt on a Xiaomi AX9000 (global version 3.0.40) and below I detail the steps I've followed as well as the issues I've encountered, hoping someone can help me resolve them.
Accessing U-Boot and Disabling Secure Boot
I accessed U-Boot via TFTP and disabled Secure Boot by executing:
IPQ807x# setenv atf 1
IPQ807x# saveenv
Saving Environment to NAND...
Erasing NAND...
Skipping bad block at 0x00d00000
Erasing at 0xd60000 -- 100% complete.
Writing to NAND... OK
2. Configuring Environment Variables
Initially, I saw recommendations to use the following commands:
nvram set uart_en=1
nvram set atf=1
nvram set boot_wait=on
nvram commit
However, my U-Boot doesn't recognize the nvram command:
IPQ807x# nvram set uart_en=1
Unknown command 'nvram' - try 'help'
So, I used the equivalent setenv commands:
setenv uart_en 1
setenv atf 1
setenv boot_wait on
saveenv
Running printenv confirms the following variables (among others):
IPQ807x# printenv
CountryCode=ES
Router_unconfigured=0
SN=34289/F1S618800
atf=1
boot_wait=on
bootcmd=tftp
bootdelay=5
color=100
eth1addr=64:64:4a:a1:71:33
eth2addr=64:64:4a:a1:71:33
eth3addr=64:64:4a:a1:71:33
eth4addr=64:64:4a:59:8b:47
eth5addr=64:64:4a:59:8b:47
ethact=eth0
ethaddr=64:64:4a:a1:71:33
fdt_high=0x4A400000
fdtcontroladdr=4a977f90
flag_boot_rootfs=1
flag_boot_success=1
flag_boot_type=2
flag_last_success=1
flag_ota_reboot=0
flag_try_sys1_failed=0
flag_try_sys2_failed=0
flash_type=2
ipaddr=192.168.31.1
machid=8010012
miot_did=444676451
miot_key=KofmGxlnkWQK8y5f
mode=Router
model=RA70
no_wifi_dev_times=0
nv_sys_pwd=9420e7c7d4209d507c80f3e1c427c2ddd83ae140
nv_wan_type=dhcp
nv_wifi_enc=psk2
nv_wifi_enc1=psk2
nv_wifi_pwd=Mandingos69
nv_wifi_pwd1=Mandingos69
nv_wifi_ssid=Xiaomi_8B47
nv_wifi_ssid1=Xiaomi_8B47_5G_Game
restore_defaults=0
serverip=192.168.31.100
soc_hw_version=200d0200
soc_version_major=2
soc_version_minor=0
ssh_en=1
stderr=serial@78B3000
stdin=serial@78B3000
stdout=serial@78B3000
telnet_en=1
uart_en=1
wl0_radio=1
wl0_ssid=xiaomi-router-ra70_miap8b47_5G
wl1_radio=1
wl1_ssid=xiaomi-router-ra70_miap8b47
wl2_ssid=xiaomi-router-ra70_8b47_5G_Game
3. Network Configuration and Loading the Initial Image
I set the device's IP address and the server's IP with:
setenv ipaddr 192.168.1.1
setenv serverip 192.168.31.100
Then, I proceeded to load the initramfs image via TFTP:
IPQ807x# tftpboot 0x44000000 openwrt-24.10.0-qualcommax-ipq807x-xiaomi_ax9000-in itramfs-uImage.itb
ipq807x_eth_halt: done
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 up Speed :1000 Full duplex
eth0 PHY4 up Speed :1000 Full duplex
eth0 PHY5 Down Speed :10 Half duplex
ipq807x_eth_init: done
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'openwrt-24.10.0-qualcommax-ipq807x-xiaomi_ax9000-initramfs-uImage.itb' .
Load address: 0x44000000
Loading: *
Got TFTP_OACK: TFTP remote port: changes from 69 to 57671
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
######################
1.9 MiB/s
done
Bytes transferred = 15586504 (edd4c8 hex)
ipq807x_eth_halt: done
bootm
4. Installing the Sysupgrade and First Boot of OpenWrt
After rebooting, I transferred the file openwrt-24.10.0-qualcommax-ipq807x-xiaomi_ax9000-squashfs-sysupgrade.bin via SCP:
scp -O openwrt-24.10.0-qualcommax-ipq807x-xiaomi_ax9000-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
Then, I logged in via SSH and accessed the OpenWrt system, where the following banner was displayed:
ssh root@192.168.1.1
BusyBox v1.36.1 (2025-02-03 23:09:37 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt 24.10.0, r28427-6df0e3d02a
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~#
I attempted to execute a command that, according to what I read, might be necessary:
fw_setenv atf 1
However, I received the following error:
Too few good blocks within range
Error: environment not initialized
Consequently, I proceeded with the sysupgrade:
cd /tmp
sysupgrade -n openwrt-24.10.0-qualcommax-ipq807x-xiaomi_ax9000-squashfs-sysupgrade.bin
The upgrade process started, and after some messages, the SSH connection was closed:
Thu Jan 1 00:13:42 UTC 1970 upgrade: Commencing upgrade. Closing all shell sessions.
Command failed: Connection failed
Connection to 192.168.1.1 closed by remote host.
The upgrade process started, and after some messages, the SSH connection was closed:
Final Issue: Boot Loop and U-Boot Errors
After the sysupgrade, the device enters an infinite boot loop. In U-Boot, I see messages such as:
Watchdog handover: fd=3
- watchdog -
Watchdog did not previously reset the system
Thu Jan 1 00:13:43 UTC 1970 upgrade: Sending TERM to remaining processes ...
Thu Jan 1 00:13:43 UTC 1970 upgrade: Sending signal TERM to netifd (2356)
Thu Jan 1 00:13:47 UTC 1970 upgrade: Sending KILL to remaining processes ...
Thu Jan 1 00:13:47 UTC 1970 upgrade: Sending signal KILL to netifd (2356)
[ 835.483100] stage2 (3880): drop_caches: 3
ubidetach: error!: cannot detach mtd21
error 19 (No such device)
ubiformat: mtd21 (nand), size 191365120 bytes (182.5 MiB), 1460 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 1459 -- 100 % complete
ubiformat: 1448 eraseblocks have valid erase counter, mean value is 0
ubiformat: 7 eraseblocks are supposedly empty
ubiformat: 4 bad eraseblocks found, numbers: 578, 579, 582, 583
ubiformat: warning!: 1 of 1456 eraseblocks contain non-UBI data
ubiformat: formatting eraseblock 1459 -- 100 % complete
ubidetach: error!: cannot detach mtd20
error 19 (No such device)
ubiformat: mtd20 (nand), size 58720256 bytes (56.0 MiB), 448 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
libscan: scanning eraseblock 447 -- 100 % complete
ubiformat: 316 eraseblocks have valid erase counter, mean value is 0
ubiformat: 132 eraseblocks are supposedly empty
ubiformat: warning!: only 316 of 448 eraseblocks have valid erase counter
ubiformat: mean erase counter 0 will be used for the rest of eraseblock
ubiformat: use erase counter 0 for all eraseblocks
ubiformat: formatting eraseblock 447 -- 100 % complete
Thu Jan 1 00:14:13 UTC 1970 upgrade: Switching to ramdisk...
Thu Jan 1 00:14:14 UTC 1970 upgrade: Performing system upgrade...
Too few good blocks within range
Error: environment not initialized
Too few good blocks within range
Error: environment not initialized
Too few good blocks within range
Error: environment not initialized
Too few good blocks within range
Error: environment not initialized
Too few good blocks within range
Error: environment not initialized
Too few good blocks within range
Error: environment not initialized
Too few good blocks within range
Error: environment not initialized
verifying sysupgrade tar file integrity
[ 855.070365] ubi0: attaching mtd20
[ 855.323005] ubi0: scanning is finished
[ 855.328849] ubi0: attached mtd20 (name "ubi_kernel", size 56 MiB)
[ 855.328892] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 855.333929] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 855.340715] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 855.347562] ubi0: good PEBs: 448, bad PEBs: 0, corrupted PEBs: 0
[ 855.354327] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[ 855.360584] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 155761407
[ 855.367624] ubi0: available PEBs: 404, total reserved PEBs: 44, PEBs reserved for bad PEB handling: 40
[ 855.376574] ubi0: background thread "ubi_bgt0d" started, PID 4712
UBI device number 0, total 448 LEBs (56885248 bytes, 54.2 MiB), available 404 LEBs (51298304 bytes, 48.9 MiB), LEB size 126976 bytes (124.0 KiB)
[ 855.418036] ubi1: attaching mtd21
[ 856.247289] ubi1: scanning is finished
[ 856.254101] ubi1: attached mtd21 (name "rootfs", size 182 MiB)
[ 856.254145] ubi1: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 856.258859] ubi1: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 856.265694] ubi1: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 856.272558] ubi1: good PEBs: 1456, bad PEBs: 4, corrupted PEBs: 0
[ 856.279331] ubi1: user volume: 0, internal volumes: 1, max. volumes count: 128
[ 856.285573] ubi1: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 1592688372
[ 856.292703] ubi1: available PEBs: 1416, total reserved PEBs: 40, PEBs reserved for bad PEB handling: 36
[ 856.302000] ubi1: background thread "ubi_bgt1d" started, PID 4736
UBI device number 1, total 1456 LEBs (184877056 bytes, 176.3 MiB), available 1416 LEBs (179798016 bytes, 171.4 MiB), LEB size 126976 bytes (124.0 KiB)
Volume ID 0, size 41 LEBs (5206016 bytes, 4.9 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
[ 856.367524] block ubiblock1_0: created from ubi1:0(rootfs)
Volume ID 0, size 77 LEBs (9777152 bytes, 9.3 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
Set volume size to 170020864
Volume ID 1, size 1339 LEBs (170020864 bytes, 162.1 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
sysupgrade successful
umount: can't unmount /dev: Resource busy
umount: can't unmount /tmp: Resource busy
[ 860.764813] remoteproc remoteproc0: stopped remote processor cd00000.q6v5_wcss
[ 861.266
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.3.1-00163
S - IMAGE_VARIANT_STRING=HAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x000002e5
B - 203 - PBL, Start
B - 2739 - bootable_media_detect_entry, Start
B - 3447 - bootable_media_detect_success, Start
B - 3451 - elf_loader_entry, Start
B - 6120 - auth_hash_seg_entry, Start
B - 43688 - auth_hash_seg_exit, Start
B - 105689 - elf_segs_hash_verify_entry, Start
B - 168544 - PBL, End
B - 274317 - SBL1, Start
B - 353556 - GCC [RstStat:0x10, RstDbg:0x600000] WDog Stat : 0x4
B - 363468 - pm_device_init, Start
B - 547383 - PM_SET_VAL:Skip
D - 181993 - pm_device_init, Delta
B - 549793 - pm_driver_init, Start
D - 5398 - pm_driver_init, Delta
B - 556167 - clock_init, Start
D - 2135 - clock_init, Delta
B - 560102 - boot_flash_init, Start
D - 12566 - boot_flash_init, Delta
B - 576450 - boot_config_data_table_init, Start
D - 3080 - boot_config_data_table_init, Delta - (575 Bytes)
B - 583922 - Boot Setting : 0x00000600
B - 587857 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:18
B - 594872 - sbl1_ddr_set_params, Start
B - 598593 - CPR configuration: 0x300
B - 602070 - cpr_init, Start
B - 604937 - Rail:0 Mode: 5 Voltage: 808000
B - 610030 - CL CPR settled at 760000mV
B - 612836 - Rail:1 Mode: 5 Voltage: 880000
B - 617106 - Rail:1 Mode: 7 Voltage: 912000
D - 16470 - cpr_init, Delta
B - 623999 - Pre_DDR_clock_init, Start
B - 627995 - Pre_DDR_clock_init, End
B - 631289 - DDR Type : PCDDR3
B - 637023 - do ddr sanity test, Start
D - 1037 - do ddr sanity test, Delta
B - 641872 - DDR: Start of HAL DDR Boot Training
B - 646508 - DDR: End of HAL DDR Boot Training
B - 652303 - DDR: Checksum to be stored on flash is 1126762879
B - 662612 - Image Load, Start
D - 507703 - QSEE Image Loaded, Delta - (1381328 Bytes)
B - 1170407 - Image Load, Start
D - 61 - SEC Image Loaded, Delta - (0 Bytes)
B - 1178093 - Image Load, Start
D - 293867 - DEVCFG Image Loaded, Delta - (32548 Bytes)
B - 1472052 - Image Load, Start
D - 305122 - RPM Image Loaded, Delta - (93060 Bytes)
B - 1777235 - Image Load, Start
D - 377346 - APPSBL Image Loaded, Delta - (583214 Bytes)
B - 2154703 - QSEE Execution, Start
D - 61 - QSEE Execution, Delta
B - 2160528 - USB D+ check, Start
D - 0 - USB D+ check, Delta
B - 2166903 - SBL1, End
D - 1894904 - SBL1, Delta
S - Flash Throughput, 6699 KB/s (2091397 Bytes, 312191 us)
S - DDR Frequency, 466 MHz
S - Core 0 Frequency, 1651 MHz
U-Boot 2016.01 (Mar 22 2022 - 03:16:43 +0000), Build: jenkins-common_router_openwrt_ota_publish-2761
DRAM: smem ram ptable found: ver: 1 len: 4
1 GiB
NAND: Could not find nand_gpio in dts, using defaults
ONFI device found
ID = 1590aaef
Vendor = ef
Device = aa
SF: Unsupported flash IDs: manuf ff, jedec ffff, ext_jedec ffff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC: sdhci: Node Not found, skipping initialization
PCI Link Intialized
PCI Link Intialized
In: serial@78B3000
Out: serial@78B3000
Err: serial@78B3000
machid: 8010012
MMC Device 0 not found
bootwait is on, bootdelay=5
Hit any key to stop autoboot: 0
It appears that there are issues with NAND block management and environment initialization, preventing the system from booting correctly.
I have followed the known steps to flash OpenWrt on this device, but after the sysupgrade, the router ends up in a boot loop and fails to start properly. Has anyone successfully flashed OpenWrt on a Xiaomi AX9000 (Global 3.0.40)? Could you offer any hints on how to resolve the errors related to "Too few good blocks within range" and environment initialization?
Thank you very much in advance for any help or suggestions!
Boot the router again with tftp and use fw_printenv
I've tried running that command in U-Boot, and it reports that it doesn't recognize it:
IPQ807x# fw_printenv
Unknown command 'fw_printenv' - try 'help'
I also attempted to execute that command and similar ones via SSH on the router, but I get similar errors:
root@OpenWrt:~# fw_setenv uart_en 1
Too few good blocks within range
Error: environment not initialized
root@OpenWrt:~# fw_setenv boot_wait on
Too few good blocks within range
Error: environment not initialized
root@OpenWrt:~# fw_printenv
Too few good blocks within range
Up until installing the initramfs version everything works fine; the problem arises when I run:
sysupgrade -n /tmp/openwrt-24.10.0-qualcommax-ipq807x-xiaomi_ax9000-squashfs-sysupgrade.bin
At that point, the router enters an infinite boot loop and fails to boot, as I mentioned in my original post.
you'd have figured it out, if you had ran the command it told you to run ...
Looks like there is something strange happening when you try to use the linux fw-printenv commands. I have read about similar cases when the hardware driver is not loaded or not available for the nvram chip in linux image. On the other hand you have managed to enable the secure boot atf. Please check the environment in u-boot with printenv command. Maybe your boot command is not correct in uboot ?