OpenWrt support for Xiaomi AX3000T

For Developers
860

My journey to flash a completely bricked bootloader:

  • Grab a raspi, connect uart to the pins in the router through the bottom of the case. Use raspi-config to enable serial port.
  • "curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh " if you dont have rust installed, apt version will fail
  • "git clone https://github.com/981213/mtk_uartboot" to grab the flasher
  • cd into mtk_uartboot, enter "cargo build", be amazed how long that few lines of code will take to compile...
  • cd into target/debug. Download snapshot build of AX3000t, place ...bl31-uboot.fip & ...preloader.bin into this directory

Now the magic fails, does anybody know why?

  • ./mtk_uartboot -s /dev/serial0 --aarch64 -p openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-preloader.bin -f openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip
mtk_uartboot - 0.1.1
Using serial port: /dev/serial0
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0xdfe2
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
==================================
Timeout waiting for specified message.

Ok, so the fallback method. Grab bl2-mt7981-bga-ddr3-ram.bin from https://github.com/981213/tf-a-mtk/releases
Now enter:
./mtk_uartboot -s /dev/serial0 --aarch64 -p bl2-mt7981-bga-ddr3-ram.bin -f openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip

mtk_uartboot - 0.1.1
Using serial port: /dev/serial0
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0x8f29
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.10.0	(release):v2.10.0-mtk
NOTICE:  BL2: Built : 13:17:06, Mar  1 2024
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE:  Received FIP 0xbc351 @ 0x40400000 ...
==================================

yeyy, router is back to life :smiley: (at least if you had a bootable system there in the first place and just shot down your bootloader). If not i think now you will be in uboot menu over uart and can flash an image.

Now proceed to flash the correct bootloader like in the howto (snapshot one for winbond flash!!)

Mabe someone can put this into the wiki?

1 Like