Ok, I've made some more progress with installing OpenWrt on the RD23 (Global version). After disabling firewall on my laptop, the tftpd64 successfully transferred the openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb file to the router, and OpenWrt has been successfully loaded into RAM:
BusyBox v1.36.1 (2024-05-05 09:27:18 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r26181-d1504a1e76
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
full console output
T T #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###
464.8 KiB/s
done
Bytes transferred = 7667712 (750000 hex)
## Loading kernel from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-6.6.29
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000e8
Data Size: 4256413 Bytes = 4.1 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x48000000
Entry Point: 0x48000000
Hash algo: crc32
Hash value: c05beb59
Hash algo: sha1
Hash value: 3dc9c2710a172b26d2b7a76ab19958d0c53e518f
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'initrd-1' ramdisk subimage
Description: ARM64 OpenWrt xiaomi_mi-router-ax3000t-ubootmod initrd
Type: RAMDisk Image
Compression: uncompressed
Data Start: 0x4640f4d4
Data Size: 3322816 Bytes = 3.2 MiB
Architecture: AArch64
OS: Linux
Load Address: unavailable
Entry Point: unavailable
Hash algo: crc32
Hash value: 1fb276b8
Hash algo: sha1
Hash value: 339d381beb6b29f6de9b57cd2a431f2b2cc00c79
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt xiaomi_mi-router-ax3000t-ubootmod device tree b lob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x4673a9b4
Data Size: 23023 Bytes = 22.5 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 625e1231
Hash algo: sha1
Hash value: 44895b19fb0776f59163c5de8fa4b2df8bfae4df
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x4673a9b4
Working FDT set to 4673a9b4
Uncompressing Kernel Image
Loading Ramdisk to 4f4cf000, end 4f7fa3c0 ... OK
Loading Device Tree to 000000004f4c6000, end 000000004f4ce9ee ... OK
Working FDT set to 4f4c6000
Add 'ramoops@42ff0000' node failed: FDT_ERR_EXISTS
Starting kernel ...
<6>[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
<5>[ 0.000000] Linux version 6.6.29 (builder@buildhost) (aarch64-openwrt-linu x-musl-gcc (OpenWrt GCC 13.2.0 r26181-d1504a1e76) 13.2.0, GNU ld (GNU Binutils) 2.42) #0 SMP Sun May 5 09:27:18 2024
<6>[ 0.000000] Machine model: Xiaomi Mi Router AX3000T (OpenWrt U-Boot layout )
<6>[ 0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 K iB) map non-reusable ramoops@42ff0000
<6>[ 0.000000] OF: reserved mem: 0x0000000043000000..0x000000004302ffff (192 KiB) nomap non-reusable secmon@43000000
<6>[ 0.000000] OF: reserved mem: 0x0000000047c80000..0x0000000047d7ffff (1024 KiB) nomap non-reusable wmcpu-reserved@47c80000
<6>[ 0.000000] OF: reserved mem: 0x0000000047d80000..0x0000000047dbffff (256 KiB) nomap non-reusable wo-emi@47d80000
<6>[ 0.000000] OF: reserved mem: 0x0000000047dc0000..0x0000000047ffffff (2304 KiB) nomap non-reusable wo-data@47dc0000
<6>[ 0.000000] Zone ranges:
<6>[ 0.000000] DMA [mem 0x0000000040000000-0x000000004fffffff]
<6>[ 0.000000] DMA32 empty
<6>[ 0.000000] Normal empty
<6>[ 0.000000] Movable zone start for each node
<6>[ 0.000000] Early memory node ranges
<6>[ 0.000000] node 0: [mem 0x0000000040000000-0x0000000042ffffff]
<6>[ 0.000000] node 0: [mem 0x0000000043000000-0x000000004302ffff]
<6>[ 0.000000] node 0: [mem 0x0000000043030000-0x0000000047c7ffff]
<6>[ 0.000000] node 0: [mem 0x0000000047c80000-0x0000000047ffffff]
<6>[ 0.000000] node 0: [mem 0x0000000048000000-0x000000004fffffff]
<6>[ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004ffffff f]
<6>[ 0.000000] psci: probing for conduit method from DT.
<6>[ 0.000000] psci: PSCIv1.1 detected in firmware.
<6>[ 0.000000] psci: Using standard PSCI v0.2 function IDs
<6>[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
<6>[ 0.000000] psci: SMC Calling Convention v1.4
<6>[ 0.000000] percpu: Embedded 18 pages/cpu s35048 r8192 d30488 u73728
<7>[ 0.000000] pcpu-alloc: s35048 r8192 d30488 u73728 alloc=18*4096
<7>[ 0.000000] pcpu-alloc: [0] 0 [0] 1
<6>[ 0.000000] Detected VIPT I-cache on CPU0
<6>[ 0.000000] CPU features: detected: GIC system register CPU interface
<6>[ 0.000000] CPU features: kernel page table isolation disabled by kernel c onfiguration
<6>[ 0.000000] alternatives: applying boot alternatives
<5>[ 0.000000] Kernel command line: console=ttyS0,115200n8 console_msg_format =syslog
<6>[ 0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes , linear)
<6>[ 0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
<6>[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 64512
<6>[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
<6>[ 0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB
<6>[ 0.000000] software IO TLB: area num 2.
<6>[ 0.000000] software IO TLB: SWIOTLB bounce buffer size roundup to 0MB
<6>[ 0.000000] software IO TLB: mapped [mem 0x000000004fe47000-0x000000004fec 7000] (0MB)
<6>[ 0.000000] Memory: 236184K/262144K available (8768K kernel code, 900K rwd ata, 2564K rodata, 384K init, 304K bss, 25960K reserved, 0K cma-reserved)
<6>[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
<6>[ 0.000000] rcu: Hierarchical RCU implementation.
<6>[ 0.000000] rcu: RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
<6>[ 0.000000] Tracing variant of Tasks RCU enabled.
<6>[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
<6>[ 0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
<6>[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
<6>[ 0.000000] GICv3: GIC: Using split EOI/Deactivate mode
<6>[ 0.000000] GICv3: 640 SPIs implemented
<6>[ 0.000000] GICv3: 0 Extended SPIs implemented
<6>[ 0.000000] Root IRQ handler: gic_handle_irq
<6>[ 0.000000] GICv3: GICv3 features: 16 PPIs
<6>[ 0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
<6>[ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
<6>[ 0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
<6>[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycl es: 0x2ff89eacb, max_idle_ns: 440795202429 ns
<6>[ 0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 43 98046511101ns
<6>[ 0.000072] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
<6>[ 0.000081] pid_max: default: 32768 minimum: 301
<6>[ 0.002975] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, lin ear)
<6>[ 0.002982] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes , linear)
<6>[ 0.005060] spectre-v4 mitigation disabled by command-line option
<4>[ 0.005146] cacheinfo: Unable to detect cache hierarchy for CPU 0
<6>[ 0.005672] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_a djust=1.
<6>[ 0.005812] rcu: Hierarchical SRCU implementation.
<6>[ 0.005815] rcu: Max phase no-delay instances is 1000.
<6>[ 0.006217] smp: Bringing up secondary CPUs ...
<6>[ 0.006578] Detected VIPT I-cache on CPU1
<6>[ 0.006621] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
<6>[ 0.006650] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
<6>[ 0.006717] smp: Brought up 1 node, 2 CPUs
<6>[ 0.006722] SMP: Total of 2 processors activated.
<6>[ 0.006726] CPU features: detected: 32-bit EL0 Support
<6>[ 0.006729] CPU features: detected: CRC32 instructions
<6>[ 0.006760] CPU features: emulated: Privileged Access Never (PAN) using TT BR0_EL1 switching
<6>[ 0.006763] CPU: All CPU(s) started at EL2
<6>[ 0.006765] alternatives: applying system-wide alternatives
<6>[ 0.010043] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
<6>[ 0.010060] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
<6>[ 0.011319] pinctrl core: initialized pinctrl subsystem
<6>[ 0.012668] NET: Registered PF_NETLINK/PF_ROUTE protocol family
<6>[ 0.013015] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocatio ns
<6>[ 0.013043] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic a llocations
<6>[ 0.013064] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
<6>[ 0.013439] thermal_sys: Registered thermal governor 'fair_share'
<6>[ 0.013443] thermal_sys: Registered thermal governor 'bang_bang'
<6>[ 0.013445] thermal_sys: Registered thermal governor 'step_wise'
<6>[ 0.013448] thermal_sys: Registered thermal governor 'user_space'
<6>[ 0.013510] ASID allocator initialised with 65536 entries
<6>[ 0.014518] pstore: Using crash dump compression: deflate
<6>[ 0.014522] pstore: Registered ramoops as persistent store backend
<6>[ 0.014525] ramoops: using 0x10000@0x42ff0000, ecc: 0
<6>[ 0.021466] Modules: 29504 pages in range for non-PLT usage
<6>[ 0.021475] Modules: 521024 pages in range for PLT usage
<6>[ 0.022295] cryptd: max_cpu_qlen set to 1000
<5>[ 0.023404] SCSI subsystem initialized
<7>[ 0.023796] libata version 3.00 loaded.
<6>[ 0.025247] clocksource: Switched to clocksource arch_sys_counter
<6>[ 0.027495] NET: Registered PF_INET protocol family
<6>[ 0.027601] IP idents hash table entries: 4096 (order: 3, 32768 bytes, lin ear)
<6>[ 0.028851] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 40 96 bytes, linear)
<6>[ 0.028864] Table-perturb hash table entries: 65536 (order: 6, 262144 byte s, linear)
<6>[ 0.028873] TCP established hash table entries: 2048 (order: 2, 16384 byte s, linear)
<6>[ 0.028890] TCP bind hash table entries: 2048 (order: 4, 65536 bytes, line ar)
<6>[ 0.028942] TCP: Hash tables configured (established 2048 bind 2048)
<6>[ 0.029011] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
<6>[ 0.029035] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear )
<6>[ 0.029301] NET: Registered PF_UNIX/PF_LOCAL protocol family
<6>[ 0.029327] PCI: CLS 0 bytes, default 64
<6>[ 0.029553] Unpacking initramfs...
<6>[ 0.036762] workingset: timestamp_bits=46 max_order=16 bucket_order=0
<6>[ 0.041574] squashfs: version 4.0 (2009/01/31) Phillip Lougher
<6>[ 0.041583] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIO RITY) (c) 2001-2006 Red Hat, Inc.
<6>[ 0.073601] Block layer SCSI generic (bsg) driver version 0.4 loaded (majo r 251)
<6>[ 0.084085] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
<6>[ 0.087164] printk: console [ttyS0] disabled
<6>[ 0.107480] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 72, base_baud = 2500000) is a ST16650V2
<6>[ 0.107522] printk: console [ttyS0] enabled
<6>[ 0.899479] loop: module loaded
<6>[ 0.905227] spi-nand spi0.0: ESMT SPI NAND was found.
<6>[ 0.910579] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048 , OOB size: 64
<6>[ 0.997306] Freeing initrd memory: 3244K
<5>[ 1.009060] 9 fixed-partitions partitions found on MTD device spi0.0
<5>[ 1.015702] Creating 9 MTD partitions on "spi0.0":
<5>[ 1.020751] 0x000000000000-0x000000100000 : "BL2"
<5>[ 1.026864] 0x000000100000-0x000000140000 : "Nvram"
<5>[ 1.032899] 0x000000140000-0x000000180000 : "Bdata"
<5>[ 1.038644] 0x000000180000-0x000000380000 : "Factory"
<5>[ 1.045804] 0x000000380000-0x000000580000 : "FIP"
<5>[ 1.053775] 0x000000580000-0x0000005c0000 : "crash"
<5>[ 1.059577] 0x0000005c0000-0x000000600000 : "crash_log"
<5>[ 1.065709] 0x000007600000-0x000007640000 : "KF"
<5>[ 1.071170] 0x000000600000-0x000007600000 : "ubi"
<6>[ 1.275846] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0 xffffffc081100000, irq 75
<6>[ 1.285850] i2c_dev: i2c /dev entries driver
<6>[ 1.292750] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, n owayout=0)
<6>[ 1.302093] NET: Registered PF_INET6 protocol family
<6>[ 1.308509] Segment Routing with IPv6
<6>[ 1.312459] In-situ OAM (IOAM) with IPv6
<6>[ 1.316719] NET: Registered PF_PACKET protocol family
<6>[ 1.322053] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
<6>[ 1.335534] 8021q: 802.1Q VLAN Support v1.8
<6>[ 1.439683] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
<6>[ 1.448944] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow cont rol rx/tx
<6>[ 1.458069] mt7530-mdio mdio-bus:1f wan (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=80)
<6>[ 1.479164] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01 ] driver [MediaTek MT7531 PHY] (irq=81)
<6>[ 1.499701] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:02 ] driver [MediaTek MT7531 PHY] (irq=82)
<6>[ 1.520214] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:03 ] driver [MediaTek MT7531 PHY] (irq=83)
<6>[ 1.532066] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode
<6>[ 1.539093] DSA: tree 0 setup
<5>[ 1.542797] UBI: auto-attach mtd8
<5>[ 1.546396] ubi0: default fastmap pool size: 40
<5>[ 1.551176] ubi0: default fastmap WL pool size: 20
<5>[ 1.556224] ubi0: attaching mtd8
<5>[ 1.932349] ubi0: scanning is finished
<5>[ 1.942153] ubi0: attached mtd8 (name "ubi", size 112 MiB)
<5>[ 1.947923] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
<5>[ 1.955048] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
<5>[ 1.962088] ubi0: VID header offset: 2048 (aligned 2048), data offset: 409 6
<5>[ 1.969302] ubi0: good PEBs: 896, bad PEBs: 0, corrupted PEBs: 0
<5>[ 1.975560] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
<5>[ 1.983027] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image s equence number: 0
<5>[ 1.991626] ubi0: available PEBs: 852, total reserved PEBs: 44, PEBs reser ved for bad PEB handling: 20
<5>[ 2.001188] ubi0: background thread "ubi_bgt0d" started, PID 604
<6>[ 2.001285] clk: Disabling unused clocks
<6>[ 2.012167] Freeing unused kernel memory: 384K
<6>[ 2.016949] Run /init as init process
<7>[ 2.020860] with arguments:
<7>[ 2.024076] /init
<7>[ 2.026610] with environment:
<7>[ 2.029999] HOME=/
<7>[ 2.032607] TERM=linux
<14>[ 2.181331] init: Console is alive
<14>[ 2.185199] init: - watchdog -
<14>[ 2.193253] kmodloader: loading kernel modules from /etc/modules-boot.d/*
<4>[ 2.203636] gpio_button_hotplug: loading out-of-tree module taints kernel.
<14>[ 2.213592] kmodloader: done loading kernel modules from /etc/modules-boo t.d/*
<14>[ 2.229471] init: - preinit -
<6>[ 2.359193] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500 base-x link mode
<6>[ 2.368059] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
<6>[ 2.380428] mt7530-mdio mdio-bus:1f lan4: configuring for phy/gmii link mo de
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
<5>[ 4.483774] random: procd: uninitialized urandom read (4 bytes read)
<14>[ 4.486317] procd: - early -
<14>[ 4.493766] procd: - watchdog -
<14>[ 5.029754] procd: - watchdog -
<14>[ 5.033401] procd: - ubus -
<5>[ 6.515254] random: crng init done
<14>[ 6.521336] procd: - init -
Please press Enter to activate this console.
<14>[ 6.697796] kmodloader: loading kernel modules from /etc/modules.d/*
<6>[ 6.712257] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0, 5,5),PE:150/433(alg:7fcdfc00)/0/0/0
<6>[ 6.727423] Loading modules backported from Linux version v6.6.15-0-g51f35 4b815c4
<6>[ 6.735165] Backport generated by backports.git 193becf2
<14>[ 6.923822] urngd: v1.0.2 started.
<4>[ 7.105368] mt798x-wmac 18000000.wifi: Direct firmware load for mediatek/m t7981_rom_patch.bin failed with error -2
<4>[ 7.115989] mt798x-wmac 18000000.wifi: Falling back to sysfs fallback for: mediatek/mt7981_rom_patch.bin
<4>[ 7.150543] mt798x-wmac: probe of 18000000.wifi failed with error -12
<6>[ 7.177953] PPP generic driver version 2.4.2
<6>[ 7.183152] NET: Registered PF_PPPOX protocol family
<14>[ 7.191994] kmodloader: done loading kernel modules from /etc/modules.d/*
<4>[ 8.272813] mtdblock: MTD device 'Bdata' is NAND, please consider using UB I block devices instead.
<6>[ 11.702672] mtk_soc_eth 15100000.ethernet eth0: Link is Down
<6>[ 11.715924] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500 base-x link mode
<6>[ 11.724694] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
<6>[ 11.731228] mt7530-mdio mdio-bus:1f lan2: configuring for phy/gmii link mo de
<6>[ 11.745845] br-lan: port 1(lan2) entered blocking state
<6>[ 11.751339] br-lan: port 1(lan2) entered disabled state
<6>[ 11.756874] mt7530-mdio mdio-bus:1f lan2: entered allmulticast mode
<6>[ 11.763395] mtk_soc_eth 15100000.ethernet eth0: entered allmulticast mode
<6>[ 11.773315] mt7530-mdio mdio-bus:1f lan2: entered promiscuous mode
<6>[ 11.793030] mt7530-mdio mdio-bus:1f lan3: configuring for phy/gmii link mo de
<6>[ 11.804086] br-lan: port 2(lan3) entered blocking state
<6>[ 11.809633] br-lan: port 2(lan3) entered disabled state
<6>[ 11.815148] mt7530-mdio mdio-bus:1f lan3: entered allmulticast mode
<6>[ 11.823801] mt7530-mdio mdio-bus:1f lan3: entered promiscuous mode
<6>[ 11.840462] mt7530-mdio mdio-bus:1f lan4: configuring for phy/gmii link mo de
<6>[ 11.852385] br-lan: port 3(lan4) entered blocking state
<6>[ 11.857924] br-lan: port 3(lan4) entered disabled state
<6>[ 11.863442] mt7530-mdio mdio-bus:1f lan4: entered allmulticast mode
<6>[ 11.872288] mt7530-mdio mdio-bus:1f lan4: entered promiscuous mode
<6>[ 11.891777] mt7530-mdio mdio-bus:1f wan: configuring for phy/gmii link mod e
<6>[ 15.836543] mt7530-mdio mdio-bus:1f lan3: Link is Up - 1Gbps/Full - flow c ontrol rx/tx
<6>[ 15.844755] br-lan: port 2(lan3) entered blocking state
<6>[ 15.850246] br-lan: port 2(lan3) entered forwarding state
^CPlease press Enter to activate this console.
^CPlease press Enter to activate this console.
BusyBox v1.36.1 (2024-05-05 09:27:18 UTC) built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r26181-d1504a1e76
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# df
Filesystem 1K-blocks Used Available Use% Mounted on
tmpfs 119904 17020 102884 14% /
tmpfs 119904 188 119716 0% /tmp
tmpfs 512 0 512 0% /dev
root@OpenWrt:/# cat /proc/mtd
dev: size erasesize name
mtd0: 00100000 00020000 "BL2"
mtd1: 00040000 00020000 "Nvram"
mtd2: 00040000 00020000 "Bdata"
mtd3: 00200000 00020000 "Factory"
mtd4: 00200000 00020000 "FIP"
mtd5: 00040000 00020000 "crash"
mtd6: 00040000 00020000 "crash_log"
mtd7: 00040000 00020000 "KF"
mtd8: 07000000 00020000 "ubi"
root@OpenWrt:/# cat /proc/cmdline
console=ttyS0,115200n8 console_msg_format=syslog
root@OpenWrt:/# mount
tmpfs on / type tmpfs (rw,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,noatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,noatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noatime)
tmpfs on /dev type tmpfs (rw,nosuid,noexec,noatime,size=512k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,noatime,mode=600,ptmxmode=000)
debugfs on /sys/kernel/debug type debugfs (rw,noatime)
bpffs on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,noatime,mode=700)
pstore on /sys/fs/pstore type pstore (rw,noatime)
root@OpenWrt:/# nanddump -f /tmp/BL2.bin /dev/mtd1
/bin/ash: nanddump: not found
root@OpenWrt:/# dd if=/dev/mtd0 of=/tmp/mtd0.backup
2048+0 records in
2048+0 records out
root@OpenWrt:/# dd if=/dev/mtd1 of=/tmp/mtd1.backup
512+0 records in
512+0 records out
root@OpenWrt:/# dd if=/dev/mtd2 of=/tmp/mtd2.backup
512+0 records in
512+0 records out
root@OpenWrt:/# dd if=/dev/mtd3 of=/tmp/mtd3.backup
4096+0 records in
4096+0 records out
root@OpenWrt:/# dd if=/dev/mtd4 of=/tmp/mtd4.backup
4096+0 records in
4096+0 records out
root@OpenWrt:/# dd if=/dev/mtd5 of=/tmp/mtd5.backup
512+0 records in
512+0 records out
root@OpenWrt:/# dd if=/dev/mtd6 of=/tmp/mtd6.backup
512+0 records in
512+0 records out
root@OpenWrt:/# dd if=/dev/mtd7 of=/tmp/mtd7.backup
512+0 records in
512+0 records out
root@OpenWrt:/tmp# dd if=/dev/mtd8 of=/tmp/mtd8.backup
229376+0 records in
229376+0 records out
root@OpenWrt:/# ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaom
i_mi-router-ax3000t-initramfs-factory.ubi
ubiformat: error!: please, first detach mtd8 (/dev/mtd8) from ubi0
root@OpenWrt:/#
After that, I tried to follow the official instructions for CN version of AX3000T at https://openwrt.org/inbox/toh/xiaomi/ax3000t and attempted to make a backup of the stock partitions using the nanddump command. It didn't work, so I used the dd command instead.
dd if=/dev/mtd0 of=/tmp/mtd0.backup
dd if=/dev/mtd1 of=/tmp/mtd1.backup
dd if=/dev/mtd2 of=/tmp/mtd2.backup
dd if=/dev/mtd3 of=/tmp/mtd3.backup
dd if=/dev/mtd4 of=/tmp/mtd4.backup
dd if=/dev/mtd5 of=/tmp/mtd5.backup
dd if=/dev/mtd6 of=/tmp/mtd6.backup
dd if=/dev/mtd7 of=/tmp/mtd7.backup
dd if=/dev/mtd8 of=/tmp/mtd8.backup
After that, I connected to the 192.168.1.1 OWRT host via WinSCP, copied the backup mtd files to laptop, and uploaded the openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi file to the router's /tmp folder.
But when I ran the command "ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi" (I executed it for mtd8 because mtd9 does not appear when I run cat /proc/mtd, so I can assume that /dev/mtd8 is correct), I encountered an error in the output console:
root@OpenWrt:/# ubiformat /dev/mtd8 -y -f /tmp/openwrt-mediatek-filogic-xiaom
i_mi-router-ax3000t-initramfs-factory.ubi
ubiformat: error!: please, first detach mtd8 (/dev/mtd8) from ubi0
Please, any suggestions of how to bypass this error. Also, I'm not sure if ubiformat can be safely executed from this system state, or if I need to execute some additional commands before running ubiformat in order to not break this RD23 model of AX3000T.
@dimfish, could you please advise?