Installation on Xiaomi AX3000T

Hello guys,
I'm trying to install OpenWrt to Xiaomi AX3000T following this procedure.

root@XiaoQiang:~# cat /proc/cmdline
console=ttyS0,115200n1 loglevel=8 swiotlb=512 rootfstype=squashfs **firmware=0** mtd=ubi uart_en=1

And then.....

ubiformat /dev/mtd9 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi
nvram set boot_wait=on
nvram set uart_en=1
nvram set flag_boot_rootfs=1
nvram set flag_last_success=1
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit
reboot

Apparently after reboot router is still back at original state and with the same IP address (192.168.31.1). I'm I doing something incorrectly, or I'm using incorret partition?

 ssh -legacy root@192.168.31.1
Warning: Permanently added '192.168.31.1' (RSA) to the list of known hosts.
sh: /usr/bin/xauth: not found


BusyBox v1.36.1 (2024-01-24 02:27:18 UTC) built-in shell (ash)

 -----------------------------------------------------
       Welcome to XiaoQiang!
 -----------------------------------------------------
  $$$$$$\  $$$$$$$\  $$$$$$$$\      $$\      $$\        $$$$$$\  $$\   $$\
 $$  __$$\ $$  __$$\ $$  _____|     $$ |     $$ |      $$  __$$\ $$ | $$  |
 $$ /  $$ |$$ |  $$ |$$ |           $$ |     $$ |      $$ /  $$ |$$ |$$  /
 $$$$$$$$ |$$$$$$$  |$$$$$\         $$ |     $$ |      $$ |  $$ |$$$$$  /
 $$  __$$ |$$  __$$< $$  __|        $$ |     $$ |      $$ |  $$ |$$  $$<
 $$ |  $$ |$$ |  $$ |$$ |           $$ |     $$ |      $$ |  $$ |$$ |\$$\
 $$ |  $$ |$$ |  $$ |$$$$$$$$\       $$$$$$$$$  |       $$$$$$  |$$ | \$$\
 \__|  \__|\__|  \__|\________|      \_________/        \______/ \__|  \__|

root@XiaoQiang:~#

Many thanks for hints!

There’s no output from the ubiformat command, does it do anything or just return the next line as in your post?

If the format doesn’t work then you are not writing the image to the flash memory.

Try the xmir patcher install instead, it’s easier and more reliable

OK, I used xmir patcher but looks that web gui is now unreachable.

C:\Users\woky\Desktop\openwrt\xmir-patcher>run.bat

==========================================================

Xiaomi MiR Patcher


 1 - Set IP-address (current value: 192.168.31.1)
 2 - Connect to device (install exploit)
 3 - Read full device info
 4 - Create full backup
 5 - Install EN/RU languages
 6 - Install Breed bootloader
 7 - Install firmware (from directory "firmware")
 8 - {{{ Other functions }}}
 9 - [[ Reboot device ]]
 0 - Exit

Select: 2

device_name = RD23
rom_version = 1.0.31 release
mac address = 00:e0:4c:68:50:e0
Current CountryCode = CZ
Enter device WEB password: xxxxxxxx
Exploit "start_binding" detected!
Run SSH server on port 22 ...
#### SSH server are activated! ####

==========================================================

Xiaomi MiR Patcher


 1 - Set IP-address (current value: 192.168.31.1)
 2 - Connect to device (install exploit)
 3 - Read full device info
 4 - Create full backup
 5 - Install EN/RU languages
 6 - Install Breed bootloader
 7 - Install firmware (from directory "firmware")
 8 - {{{ Other functions }}}
 9 - [[ Reboot device ]]
 0 - Exit

Select: 7

device: "RD23"
img_write = True
Image files in directory "firmware/":
  "firmware/openwrt-23.05.5-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi"
Download file: "/tmp/dmesg.log" ....
Download file: "/tmp/mtd_list.txt" ....
Download file: "/tmp/mtd_info.txt" ....
Download file: "/tmp/mtd_fdt.txt" ....
Download file: "/tmp/kcmdline.log" ....
Parse all images...
UBI: filetype: b'UBI#'
UBI: Decoding UBIFS...
UBI:   volume: "kernel"          size: 7364608
parse_ubifs = 1
FIT size = 0x6F7518 (7133 KiB)
FIT: name = "ARM64 OpenWrt FIT (Flattened Image Tree)"
FIT: def_cfg: "config-1"
FIT: def_cfg desc = "OpenWrt xiaomi_mi-router-ax3000t"
FIT: model = "xiaomi,mi-router-ax3000t"
FIT: def_fdt: "fdt-1"
FDT: desc = "ARM64 OpenWrt xiaomi_mi-router-ax3000t device tree blob"
FDT: type = "flat_dt"
FDT: arch = "arm64"
KRN: desc = "ARM64 OpenWrt Linux-5.15.167"
KRN: type = "kernel"
KRN: arch = "arm64"
KRN: compression = "lzma"
KRN: data = 3781530 bytes
FDT: compatible = ['xiaomi,mi-router-ax3000t', 'mediatek,mt7981']
FDT: model = "Xiaomi Mi Router AX3000T"
FDT: dt_part: ['/spi@1100a000/flash@0/partitions']
FIT: Founded "initrd-1" node
FIT: initrd image name: "ARM64 OpenWrt xiaomi_mi-router-ax3000t initrd"
fw_img: 8320 KiB | kernel: 7133 KiB | rootfs: 3415 KiB
Download file: "/tmp/bl_BL2.bin" ....
Download file: "/tmp/bl_FIP.bin" ....
Download file: "/tmp/env_Nvram.bin" ....
Download file: "/tmp/env_Bdata.bin" ....
Download file: "/tmp/env_BL2.bin" ....
current flag_boot_rootfs = 0
install_method = 400
--------- prepare command lines -----------
fw_img: 8320 KiB | kernel: 7133 KiB | rootfs: 3415 KiB
------------- flash images -------------
Upload file: "tmp/fw/fw_img.bin" ....
Download file: "/tmp/fw_img.bin.278960.md5" ....
Writing firmware image to addr 0x02800000 ...
  mtd -e "ubi1" write "/tmp/fw_img.bin" "ubi1"
Download file: "/tmp/mtd9_0_8519680_444789.md5" ....
Run scripts for change NVRAM params...
Boot from firmware [1] activated.
Download file: "/tmp/nvram.txt" ....
The firmware has been successfully flashed!
Send command "reboot" via SSH/Telnet ...
Forced REBOOT Activated!

I logged to gui and there was message about "System running in recovery (initramfs) mode."

I followed step 5 of installation procedure

root@OpenWrt:~# sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin
verifying sysupgrade tar file integrity
Thu Nov 21 21:07:59 UTC 2024 upgrade: Commencing upgrade. Closing all shell sessions.
Command failed: Connection failed
root@OpenWrt:~# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

Now device is available only through SSH as root, management web gui is unreachable.

i don't know xmir-tool but maybe it installs snapshot?
did you try to install luci?
what is the output of:

ubus call system board

 ssh -legacy root@192.168.1.1
X11 forwarding request failed on channel 0


BusyBox v1.36.1 (2024-11-21 21:04:41 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r28146-52b6c92479
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# ubus call system board
{
        "kernel": "6.6.61",
        "hostname": "OpenWrt",
        "system": "ARMv8 Processor rev 4",
        "model": "Xiaomi Mi Router AX3000T",
        "board_name": "xiaomi,mi-router-ax3000t",
        "rootfs_type": "squashfs",
        "release": {
                "distribution": "OpenWrt",
                "version": "SNAPSHOT",
                "revision": "r28146-52b6c92479",
                "target": "mediatek/filogic",
                "description": "OpenWrt SNAPSHOT r28146-52b6c92479",
                "builddate": "1732223081"
        }
}
root@OpenWrt:~#
root@OpenWrt:~# client_loop: send disconnect: Connection reset by peer

After moment the SSH session is interrupted and client disconnects.

It indeed looks that installed is snapshot.

Would you have clue how eventually restore device to the original state?

Try first with apk update , then apk add luci.

If that fails, go to the Firmware Selector and download the image from there. Those include luci by default. You can add more packages that you might want there.

Then, transfer it to /tmp via SCP and install it with sysupgrade -v /tmp/[name of the image].bin

Already tried this. I added luci and kmod, unfortunately when running sysupgrade the sessions is closed, so flash is not executed.

root@OpenWrt:~# sysupgrade -n /tmp/tmp/openwrt-23.05.5-e70b192a6f43-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin
verifying sysupgrade tar file integrity
Thu Nov 21 21:51:19 UTC 2024 upgrade: Commencing upgrade. Closing all shell sessions.
Command failed: Connection failed
root@OpenWrt:~# Connection to 192.168.1.1 closed by remote host.
Connection to 192.168.1.1 closed.

I wanted to try to reflash initramfs-factory and try to flash squashfs-sysupgrade from the web gui, apparently mtd9 is probably somehow mounted.

root@OpenWrt:~# ubiformat /dev/mtd9 -y -f /tmp/tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-factory2.ubi
ubiformat: error!: please, first detach mtd9 (/dev/mtd9) from ubi0

I see that xmir tool did in it's folder probably some backup, would you know how to restore it?

It's pretty normal that SSH closes after executing the sysupgrade. The weird thing is that you don't have an updated image installed after with luci.

Maybe you need serial access to recover, but I don't own that model. I've used OpenWRT for like 10 years. A friend has an AX3000T and I'm interested in that model to eventually install OpenWRT.

Which device do you have?? RD03? RD23? What about the flash and the switch? Maybe you have one with the new switch and that's causing you trouble. Maybe ask on the main AX3000T thread.

My friend's has an RD03 with ESMT chip and 1.0.64 FW version. I plan to install OpenWRT eventually. Maybe when 24.10 stable is released.

Did you wait for 1-2 minutes for flashing?
If no you possible need to unbrick with the link you posted.

If not, you could try a 24.10-snapshot version.

more infos are here.