OpenWrt support for Xiaomi AX9000

For Developers
2026

You need to use the create_exploit.zip with size 34kb for the international version The smaller one works for the Chinese.

Matti

1 Like
2027

Thanks for tip - it worked with create_exploit_hdr2.js. Somehow i skipped this one.

1 Like
2028

Selling with reasonable price atm (149€) Mi Router AX9000 | Intelligent router for serious gamers

Another even cheaper shop in Finland 115€ Xiaomi AX9000 GL WiFi6-reititin | Karkkainen.com verkkokauppa

2030

hello there,

where to get the exploit to get ssh access to ax9000 ?

i am on international firmware

uart tx pin diabled

can anybody send the exploit needed

2031

hello

i have installed openwrt latest image on ax9000.

there are many problems with the wireless radio.

can anybody send me the best openwrt imgae with nss support.

many thanks

2032

it's works thanks so much bro @devrus91 , great job :+1:

Capture3
Capture3874×742 19.3 KB

1 Like
2033

where to download this fan control ???

2034

i have another problem with a9000 router and latest openwrt…

i cannot connect with qcn9074 radio 3 ???

i tested different options with different channels and bands… no connection possible ???

i also tested this from openwrt wiki:

An issue on the lower 5 GHz band radio (QCN9024) caused by the current BDF file (as 17/12/2022) is leading to non-connecting issues. Proposed by avanletin, a workaround is available, following the instructions below:

  1. Paste the entire command into a linux terminal to generate a new BDF file board-2.bin compressed.

  2. Backup the current board-2.bin file on the AX9000: cd /lib/firmware/ath11k/QCN9074/hw1.0 && mv ./board-2.bin ./board-2.bin_stock.

  3. Copy the compressed file generic-ax9000.tar.gz into the root directory (/) on the AX9000.

  4. Uncompress the BDF file: tar -xzvf generic-ax9000.tar.gz.

  5. Reboot the router.

also no connection possible

have anybody here solution ???

thanks in advance

2035

for fan control you can , install manual from this https://github.com/devrus91/openwrt-alpine-fan-control/releases/tag/1.1
and for the band radio (QCN9024) just enter the file location manually, then replace the file " board-2.bin " and set country code to US , chanel 64, 160mhz, transit power dBm ( i use this setting) save apply and restart radio

2036 
opkg install /tmp/alpine-fan-control-*.ipk
opkg install /tmp/luci-app-alpine-fan-control-*.ipk

error untrusted signature ???

then tested an other option

apk add --allow-untrusted /tmp/alpine-fan-control.ipk


ERROR: /tmp/alpine-fan-control.ipk: v2 package format error

can anybody help

i use latest nss image from lorenzo

information about image:

Hostname OpenWrt
Model Xiaomi AX9000
Architecture ARMv8 Processor rev 4
Target Platform qualcommax/ipq807x
Firmware Version OpenWrt SNAPSHOT r0-27c2d2f2 / LuCI Master 25.351.34363~3bd538a
Kernel Version 6.12.62
2037

i have testet as you described – no connection possible to radio 3

can you send me your board-2.bin

thanks

ok solved

copied manually board-2.bin generated by wiki help and now i can connect - solved

2038

try use immortal version 24.10, works fine on me

2039

no i want to stay on nss images from lorenzo..

i think these are are best images with the latest patches for ax9000.

perhaps devrus91 can compile a new version of his fan control and sign it for new kernels like 6.12.92 for latest openwrt snapshot images…

thanks in advance

2040

u can try this command, after that reenable fan control.

2041

i want to try this frimware , where i can download it?any links?

2042

installed openwrt 24.10…

now i can install fan control

also installed kmod-hwmon-emc2305

but there is an error….

alpine-fan-controller: ERROR: fan controller emc230 not found

2043

ok got fan control installed

but in the end error:

alpine-fan-controller: ERROR: thermal sensor tmp75 not found

2044

@amigo74 Have you got i2c-tools installed as well? Had to piece it together from a bunch of posts but I think everything required is:

  1. be on 24.10

  2. upload/install both .ipk files from @devrus91 here via luci System>Software>Upload Package

  3. install i2c-tools and kmod-hwmon-emc2305 via luci System>Software

  4. Add the below in Luci System>Startup>Local Startup

echo emc2301 0x2f >  /sys/bus/i2c/devices/i2c-0/new_device
i2cset -f -y 0 0x2f 0x38 0x18 
i2cset -f -y 0 0x2f 0x2b 0x01
echo 60 > /sys/class/hwmon/hwmon4/pwm1
exit 0
  1. Reboot router.

Think that’s everything I did last night to get it working.

2 Likes
2045

I’ve updated the wiki to include the Fan controller installation:

It’s better to initialize the hardware through init.d instead of rc.common, and also good to add failsafes:

Failsafe watchdog:

Create:

/usr/sbin/fan-failsafe.sh

#!/bin/sh

SAFE_PWM=40

while true; do
if ! pgrep -x alpine-fan-controller >/dev/null; then
for hw in /sys/class/hwmon/hwmon*; do
[ -f "$hw/name" ] || continue
if grep -q emc2301 "$hw/name"; then
echo $SAFE_PWM > "$hw/pwm1"
fi
done
fi
sleep 10
done

Make executable:

chmod +x /usr/sbin/fan-failsafe.sh

Run it under procd:

Create:

/etc/init.d/fan-failsafe

#!/bin/sh /etc/rc.common

START=98
USE_PROCD=1

start_service() {
procd_open_instance
procd_set_param command /usr/sbin/fan-failsafe.sh
procd_set_param respawn
procd_close_instance
}

Enable it:

chmod +x /etc/init.d/fan-failsafe
/etc/init.d/fan-failsafe enable
4 Likes
2046

instead of…

echo 60 > /sys/class/hwmon/hwmon4/pwm1

it’s safer to use…

HWMON=$(grep -l emc2301 /sys/class/hwmon/hwmon*/name | sed 's|/name||')
echo 60 > "$HWMON/pwm1"

as the hwmonX numbering could be different from 4, and above checks and uses the right one

but as mentioned above it’s better to use init.d, please refer to the wiki, there’s also no need to set the fan manually with “echo 60 > …” because the alpine-fan-control takes this job over and sets the fan speed depending on the temps

1 Like