OpenWrt support for Xiaomi AX3000T

For Developers
314

Thanks for your help.
Here is the dmesg output after the reset:

BusyBox v1.36.1 (2024-04-24 12:12:15 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r26009-6ca8305598
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:~# dmesg 
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.1.86 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 13.2.0 r26009-6ca8305598) 13.2.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Wed Apr 24 12:12:15 2024
[    0.000000] Machine model: Xiaomi Mi Router AX3000T
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x0000000047c7ffff]
[    0.000000]   node   0: [mem 0x0000000047c80000-0x0000000047ffffff]
[    0.000000]   node   0: [mem 0x0000000048000000-0x000000004fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 18 pages/cpu s33896 r8192 d31640 u73728
[    0.000000] pcpu-alloc: s33896 r8192 d31640 u73728 alloc=18*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1 
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64512
[    0.000000] Kernel command line: console=ttyS0,115200n1 loglevel=8 swiotlb=512 rootfstype=squashfs firmware=0 mtd=ubi uart_en=1
[    0.000000] Unknown kernel command line parameters "firmware=0 mtd=ubi uart_en=1", will be passed to user space.
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 240212K/262144K available (8576K kernel code, 894K rwdata, 2472K rodata, 448K init, 304K bss, 21932K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: 	RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000] 	Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv3: GICv3 features: 16 PPIs
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000072] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000080] pid_max: default: 32768 minimum: 301
[    0.000358] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.000366] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.001167] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.001574] cblist_init_generic: Setting adjustable number of callback queues.
[    0.001579] cblist_init_generic: Setting shift to 1 and lim to 1.
[    0.001703] rcu: Hierarchical SRCU implementation.
[    0.001705] rcu: 	Max phase no-delay instances is 1000.
[    0.002086] smp: Bringing up secondary CPUs ...
[    0.002414] Detected VIPT I-cache on CPU1
[    0.002468] cacheinfo: Unable to detect cache hierarchy for CPU 1
[    0.002476] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.002505] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.002568] smp: Brought up 1 node, 2 CPUs
[    0.002573] SMP: Total of 2 processors activated.
[    0.002576] CPU features: detected: 32-bit EL0 Support
[    0.002579] CPU features: detected: CRC32 instructions
[    0.002607] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.002610] CPU: All CPU(s) started at EL2
[    0.002612] alternatives: applying system-wide alternatives
[    0.006191] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.006209] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.006335] pinctrl core: initialized pinctrl subsystem
[    0.007160] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.007511] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.007546] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.007567] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.007945] thermal_sys: Registered thermal governor 'fair_share'
[    0.007949] thermal_sys: Registered thermal governor 'bang_bang'
[    0.007952] thermal_sys: Registered thermal governor 'step_wise'
[    0.007954] thermal_sys: Registered thermal governor 'user_space'
[    0.008044] ASID allocator initialised with 65536 entries
[    0.008487] pstore: Registered ramoops as persistent store backend
[    0.008490] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.018815] cryptd: max_cpu_qlen set to 1000
[    0.019858] SCSI subsystem initialized
[    0.020079] libata version 3.00 loaded.
[    0.021409] clocksource: Switched to clocksource arch_sys_counter
[    0.022132] NET: Registered PF_INET protocol family
[    0.022226] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.022702] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.022720] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.022736] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.022754] TCP bind hash table entries: 2048 (order: 4, 65536 bytes, linear)
[    0.022808] TCP: Hash tables configured (established 2048 bind 2048)
[    0.022897] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.022917] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.023068] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.023094] PCI: CLS 0 bytes, default 64
[    0.023938] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.027728] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.027738] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.062714] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.071936] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.074293] printk: console [ttyS0] disabled
[    0.094411] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 72, base_baud = 2500000) is a ST16650V2
[    0.766304] printk: console [ttyS0] enabled
[    0.771271] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.781077] loop: module loaded
[    0.785654] spi spi0.0: setup: ignoring unsupported mode bits a00
[    0.792096] spi-nand spi0.0: ESMT SPI NAND was found.
[    0.797148] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    0.805895] Signature found at block 1023 [0x07fe0000]
[    0.811026] NMBM management region starts at block 960 [0x07800000]
[    0.819171] First info table with writecount 0 found in block 960
[    0.830810] Second info table with writecount 0 found in block 963
[    0.836995] NMBM has been successfully attached
[    0.841874] 10 fixed-partitions partitions found on MTD device spi0.0
[    0.848316] Creating 10 MTD partitions on "spi0.0":
[    0.853199] 0x000000000000-0x000000100000 : "BL2"
[    0.859145] 0x000000100000-0x000000140000 : "Nvram"
[    0.864719] 0x000000140000-0x000000180000 : "Bdata"
[    0.870278] 0x000000180000-0x000000380000 : "Factory"
[    0.877537] 0x000000380000-0x000000580000 : "FIP"
[    0.884182] 0x000000580000-0x0000005c0000 : "crash"
[    0.889723] 0x0000005c0000-0x000000600000 : "crash_log"
[    0.895597] 0x000007600000-0x000007640000 : "KF"
[    0.900868] 0x000000600000-0x000002800000 : "ubi_kernel"
[    0.931552] 0x000002800000-0x000007600000 : "ubi"
[    1.137962] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc009580000, irq 75
[    1.147717] i2c_dev: i2c /dev entries driver
[    1.154490] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    1.163393] NET: Registered PF_INET6 protocol family
[    1.169223] Segment Routing with IPv6
[    1.173034] In-situ OAM (IOAM) with IPv6
[    1.177010] NET: Registered PF_PACKET protocol family
[    1.182102] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.195240] 8021q: 802.1Q VLAN Support v1.8
[    1.200902] pstore: Using crash dump compression: deflate
[    1.264636] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[    1.273971] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.290160] mt7530-mdio mdio-bus:1f wan (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=80)
[    1.310693] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=81)
[    1.330929] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=82)
[    1.351158] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=83)
[    1.362703] device eth0 entered promiscuous mode
[    1.367361] DSA: tree 0 setup
[    1.371080] UBI: auto-attach mtd9
[    1.374421] ubi0: default fastmap pool size: 30
[    1.378941] ubi0: default fastmap WL pool size: 15
[    1.383727] ubi0: attaching mtd9
[    1.933898] ubi0: scanning is finished
[    1.948287] ubi0: attached mtd9 (name "ubi", size 78 MiB)
[    1.953709] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    1.960571] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    1.967350] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    1.974301] ubi0: good PEBs: 624, bad PEBs: 0, corrupted PEBs: 0
[    1.980294] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    1.987506] ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 762275729
[    1.996539] ubi0: available PEBs: 0, total reserved PEBs: 624, PEBs reserved for bad PEB handling: 19
[    2.005751] ubi0: background thread "ubi_bgt0d" started, PID 460
[    2.007795] block ubiblock0_0: created from ubi0:0(rootfs)
[    2.017267] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem
[    2.030857] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    2.038204] Freeing unused kernel memory: 448K
[    2.042741] Run /sbin/init as init process
[    2.046826]   with arguments:
[    2.049780]     /sbin/init
[    2.052483]   with environment:
[    2.055610]     HOME=/
[    2.057958]     TERM=linux
[    2.060652]     firmware=0
[    2.063362]     mtd=ubi
[    2.065796]     uart_en=1
[    2.294227] init: Console is alive
[    2.297769] init: - watchdog -
[    2.747193] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.781192] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.794977] init: - preinit -
[    3.256788] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    3.265480] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    3.274215] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    3.280876] mt7530-mdio mdio-bus:1f lan4: configuring for phy/gmii link mode
[    4.011409] random: crng init done
[    5.446856] UBIFS (ubi0:1): Mounting in unauthenticated mode
[    5.452619] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 594
[    5.506260] UBIFS (ubi0:1): recovery needed
[    5.698372] UBIFS (ubi0:1): recovery completed
[    5.702891] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[    5.710710] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    5.720616] UBIFS (ubi0:1): FS size: 70598656 bytes (67 MiB, 556 LEBs), max 566 LEBs, journal size 3555328 bytes (3 MiB, 28 LEBs)
[    5.732257] UBIFS (ubi0:1): reserved for root: 3334548 bytes (3256 KiB)
[    5.738857] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 405C4263-B0F4-4842-AB0A-E130BA87F7C4, small LPT model
[    5.751068] mount_root: overlay filesystem has not been fully initialized yet
[    5.758500] mount_root: switching to ubifs overlay
[    5.766865] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
[    5.778140] urandom-seed: Seed file not found (/etc/urandom.seed)
[    5.834655] procd: - early -
[    5.837605] procd: - watchdog -
[    6.392811] procd: - watchdog -
[    6.396391] procd: - ubus -
[    6.550112] procd: - init -
[    6.828738] kmodloader: loading kernel modules from /etc/modules.d/*
[    6.881344] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[    6.900871] Loading modules backported from Linux version v6.6.15-0-g51f354b815c4
[    6.908430] Backport generated by backports.git 193becf2
[    7.038137] urngd: v1.0.2 started.
[    7.266135] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20221208201745a
[    7.266135] 
[    7.493897] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20221208201806
[    7.606427] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20221208202048
[    7.698692] mt798x-wmac 18000000.wifi: registering led 'mt76-phy0'
[    7.706792] mt798x-wmac 18000000.wifi: registering led 'mt76-phy1'
[    9.932607] PPP generic driver version 2.4.2
[    9.937656] NET: Registered PF_PPPOX protocol family
[    9.945542] kmodloader: done loading kernel modules from /etc/modules.d/*
[   11.077271] mtdblock: MTD device 'Bdata' is NAND, please consider using UBI block devices instead.
[   16.394665] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   16.407810] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   16.416377] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   16.421074] mt7530-mdio mdio-bus:1f lan2: configuring for phy/gmii link mode
[   16.436034] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   16.442749] br-lan: port 1(lan2) entered blocking state
[   16.447982] br-lan: port 1(lan2) entered disabled state
[   16.456101] device lan2 entered promiscuous mode
[   16.472198] mt7530-mdio mdio-bus:1f lan3: configuring for phy/gmii link mode
[   16.482110] br-lan: port 2(lan3) entered blocking state
[   16.487342] br-lan: port 2(lan3) entered disabled state
[   16.494743] device lan3 entered promiscuous mode
[   16.507739] mt7530-mdio mdio-bus:1f lan4: configuring for phy/gmii link mode
[   16.518174] br-lan: port 3(lan4) entered blocking state
[   16.523454] br-lan: port 3(lan4) entered disabled state
[   16.530772] device lan4 entered promiscuous mode
[   16.544666] mt7530-mdio mdio-bus:1f wan: configuring for phy/gmii link mode
[   20.380431] mt7530-mdio mdio-bus:1f lan3: Link is Up - 1Gbps/Full - flow control rx/tx
[   20.388391] br-lan: port 2(lan3) entered blocking state
[   20.393623] br-lan: port 2(lan3) entered forwarding state
[   20.399694] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready

It's currently running the snapshot image.

315

As I see, you have snapshot on the board, may be better to simplify issue - install last release 23.05.3 (without keep settings).
Right now no any exceptions in the log, but it’s snapshot and no guarantee to stability.

316

Hi All,
I have a problem with finishing the installation.
I stuck in this point: https://openwrt.org/inbox/toh/xiaomi/ax3000t#change_to_openwrt_u-boot
When I try to do

insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1

I'm getting the response:

Failed to find mtd-rw. Maybe it is a built in module ?

the file ls /lib/modules/6.1.86/mtd-rw.ko exist.

What should I do to move forward or go back?

317

Try

insmod mtd-rw i_want_a_brick=1

It’s the same, but no requirement to input the the path and file extension of module

And as for me, this command should be corrected in the wiki

318

I understand that there are regional restrictions. But the 3000T does not have FEM chips.
I'm trying to understand where 28dBm (600mWt) comes from in this router, this is a huge power.
How does OpenWrt even determine the range of available power levels? Is this recorded in the eeprom?
How does this 28dBm correspond to real power?

319

Unfortunately your suggestions is not working.
Maybe more details:

opkg update && opkg install kmod-mtd-rw

returns:

Downloading https://downloads.openwrt.org/snapshots/targets/mediatek/filogic/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_core
Downloading https://downloads.openwrt.org/snapshots/targets/mediatek/filogic/packages/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/base/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_base
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/base/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/targets/mediatek/filogic/kmods/6.1.86-1-d9dbb4ef501bca8204690592f8179c05/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_kmods
Downloading https://downloads.openwrt.org/snapshots/targets/mediatek/filogic/kmods/6.1.86-1-d9dbb4ef501bca8204690592f8179c05/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/luci/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_luci
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/luci/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/packages/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_packages
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/packages/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/routing/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_routing
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/routing/Packages.sig
Signature check passed.
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/telephony/Packages.gz
Updated list of available packages in /var/opkg-lists/openwrt_telephony
Downloading https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/telephony/Packages.sig
Signature check passed.
Installing kmod-mtd-rw (6.1.86.2021.02.28~e8776739-r1) to root...
Downloading https://downloads.openwrt.org/snapshots/targets/mediatek/filogic/kmods/6.1.86-1-d9dbb4ef501bca8204690592f8179c05/kmod-mtd-rw_6.1.86.2021.02.28~e8776739-r1_aarch64_cortex-a53.ipk
Configuring kmod-mtd-rw.

but both

insmod mtd-rw i_want_a_brick=1
insmod kmod-mtd-rw i_want_a_brick=1

still returns

Failed to find mtd-rw. Maybe it is a built in module ?

I checked twice, and the file exist:

ls /lib/modules/6.1.86/mtd-rw.ko
/lib/modules/6.1.86/mtd-rw.ko

I do not need U-Boot. I wlould like to kntow how to go back, because instrucion from here: https://openwrt.org/inbox/toh/xiaomi/ax3000t#go_back_to_stock_from_openwrt_u-boot
still requires mtd-rw.

320

I don’t know why still mans trying to install snapshot build (it’s a test build for OpenWrt developers). Please think about install 23.05.3 release.

321

Have I missed something, where's the official 23.05.3 build.

322

Received two units of the AX3000T today, both are the RD23 model (Global version).

image

1
11920×856 123 KB

device_name = RD23
rom_version = 1.0.31 release
mac address = xx:xx:xx:xx:xx:xx
Detect using xiaoqiang "hackCheck" fix (wink)
Enable smartcontroller scene executor ...
Wait smartcontroller activation ...
ERROR: Exploit "smartcontroller" not working!!!

It would be great to install OpenWrt on these RD23 devices....
I have a UART RS232 TTL CH340G adapter, so I'm going to try it soon. Currently, I only have instructions for flashing a different router model via UART adapter: https://github.com/mikeeq/xiaomi_ax3200_openwrt?tab=readme-ov-file#uart-flash (I intend to follow the same steps for RD23). However, since this is my first time with CH340 adapter, I would greatly appreciate it if someone could guide me through any commands that might need to be different for RD23, especially for the initial steps. Guys, I really need your suggestions, please :slightly_smiling_face:.

Which command should I start with to determine whether OpenWrt can be flashed on the device, or if it is vendor-locked against any flashing via UART?

I'd be happy to extract a complete dump from my AX3000T RD23 model. Which commands do I need to execute?

2 Likes
323

Not official yet(
But you have two options:

1 Like
324

I don't have a solution. Try to get access via usb-ttl (ability to enter commands from the console).

325

I'm exactly on the same spot: received two RD23s, and also have the UART RS232 TTL CH340G adapter - I'm willing to give it a go and see if I can install it. Need some guidance though. I'm new to the openwrt world :slight_smile:

1 Like
326

Unfortunately still doesn't work. Tried remmitor's latest build, all looks good but WLAN interfaces don't work. I see them enabled, going up/down but the network is not being broadcasted.

System log:

Kernel log:

I have tried playing with channel width and different modes (AX, AC, etc.) but still no luck. The SSID appeared shortly for a couple of times but won't let me connect to it and then disappears again.

Wifi settings (2.4 Ghz disabled intentionally):

root@OpenWrt:/etc/config# uci show wireless
wireless.radio0=wifi-device
wireless.radio0.type='mac80211'
wireless.radio0.path='platform/18000000.wifi'
wireless.radio0.channel='auto'
wireless.radio0.band='2g'
wireless.radio0.htmode='HE20'
wireless.radio0.disabled='1'
wireless.radio0.country='US'
wireless.radio0.cell_density='0'
wireless.default_radio0=wifi-iface
wireless.default_radio0.device='radio0'
wireless.default_radio0.mode='ap'
wireless.default_radio0.ssid='AX3000T-2G'
wireless.default_radio0.encryption='psk2'
wireless.default_radio0.key='12345678'
wireless.default_radio0.disabled='1'
wireless.radio1=wifi-device
wireless.radio1.type='mac80211'
wireless.radio1.path='platform/18000000.wifi+1'
wireless.radio1.channel='auto'
wireless.radio1.band='5g'
wireless.radio1.htmode='VHT80'
wireless.radio1.disabled='0'
wireless.radio1.country='BG'
wireless.radio1.cell_density='0'
wireless.default_radio1=wifi-iface
wireless.default_radio1.device='radio1'
wireless.default_radio1.mode='ap'
wireless.default_radio1.ssid='AX3000T-5G'
wireless.default_radio1.encryption='psk2'
wireless.default_radio1.key='12345678'
327

Hi,
please, correct (1), check (2) item and (3)-(4) - check possibility to change.

  1. Your WiFI is disabled

wireless.default_radio0.disabled='1'

  1. Network interface is missing for WiFi (radio0 & radio1)

wireless.default_radio0.network='lan'
wireless.default_radio1.network='lan'

  1. AC (WiFi-5, htmode='VHT80') for radio1, may be better to set AX here (WiFI-6, htmode='HE80')

wireless.radio1.htmode='VHT80'

  1. Different country code for radio0 & radio1:

wireless.radio1.country='BG'
wireless.radio0.country='US

328

Hello everybody! Is it possible to implement a USB MOD on this router?

329

I connected the UART adapter to the AX3000T RD23 model, and the boot log is stuck on the message NOTICE: Hello BL31!!!.

1714249091190
17142490911901920×1081 242 KB

full bootlog text

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024F [010F]
Jump to BL

NOTICE: BL2: v2.6(release):9548a30134d-dirty
NOTICE: BL2: Built : 02:27:18, Jan 24 2024
NOTICE: WDT: disabled
NOTICE: EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 620, worse bit 4, min window 72
Window Sum 584, worse bit 8, min window 72
Window Sum 420, worse bit 0, min window 50
Window Sum 364, worse bit 10, min window 44
Window Sum 432, worse bit 0, min window 52
Window Sum 372, worse bit 13, min window 44
Window Sum 442, worse bit 0, min window 54
Window Sum 382, worse bit 11, min window 46
Window Sum 450, worse bit 6, min window 54
Window Sum 394, worse bit 9, min window 48
Window Sum 454, worse bit 0, min window 54
Window Sum 396, worse bit 9, min window 48
Window Sum 458, worse bit 2, min window 56
Window Sum 464, worse bit 6, min window 56
Window Sum 418, worse bit 11, min window 50
Window Sum 466, worse bit 0, min window 58
Window Sum 422, worse bit 8, min window 50
NOTICE: EMI: Detected DRAM size: 256MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: CPU: MT7981 (1300MHz)
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0xc8
NOTICE: Page size 2048, Block size 131072, size 134217728
NOTICE: Initializing NMBM ...
NOTICE: Signature found at block 1023 [0x07fe0000]
NOTICE: First info table with writecount 0 found in block 960
NOTICE: Second info table with writecount 0 found in block 963
NOTICE: NMBM has been successfully attached in read-only m ode
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.6(release):9548a30134d-dirty
NOTICE: BL31: Built : 02:27:18, Jan 24 2024
NOTICE: Hello BL31!!!

It's weird but I'm unable to find the stock firmware ver. 1.0.31 for the Global version of the AX3000T (or am I looking in the wrong place?), but flashing the stock firmware seems to be a mandatory step for booting into the U-Boot console:

  1. After the second TFTP flash, during the boot time you will have an option to boot to U-Boot Console (last option in bootmenu), choose that, now you should be able to see the terminal prompt MT7622>

Also here it's mentioned that setting uart_en=1 in the Bdata partition enables UART output. However, I'm unable to input this in PuTTY because I only see the message NOTICE: Hello BL31!!! and can't enter any text.

It seems the only option is to wait until stock firmware version 1.0.31 is published, and only after that I can try to access the U-Boot Boot Menu via the UART console and proceed with UART flashing.

But if anyone has suggestions on alternative ways to gain access to mtk_uartboot, please feel free to share them. Thanks.

1 Like
330

You seem to be confusing mtk_uartboot with access to the stock firmware's u-boot menu?

Should be able to load your own u-boot image and (optionally, but probably easiest) initramfs image, then dump it all to /tmp and scp it all off...

1 Like
331

Thanks! I've made some progress with it.
Here's what I did:

  1. downloaded mtk_uartboot-v0.1.1-x86_64-pc-windows-msvc.zip for windows and unpacked it.
  2. downloaded bl2-mt7981-bga-ddr3-ram.bin and placed it in the folder with mtk_uartboot.exe.
  3. downloaded openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip and openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb and placed it in the folder with mtk_uartboot.exe.
  4. executed the following command in the windows cmd console:
mtk_uartboot -s COM5 --payload bl2-mt7981-bga-ddr3-ram.bin --aarch64 --fip openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip && putty.exe -serial COM5 -sercfg 115200,8,n,1,N

The command executes correctly in the Windows console, the router light indicator is in blue, but I see some errors in PuTTY:

ARP Retry count exceeded; starting again
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-r              ecovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *

Screenshot_4
Screenshot_41496×727 67.6 KB

full console output 
C:\3\mtk_uartboot-v0.1.1-x86_64-pc-windows-msvc>mtk_uartboot -s COM5 --payload bl2-mt7981-bga-ddr3-ram.bin --aarch64 --fip openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip && putty.exe -serial COM5 -sercfg 115200,8,n,1,N
mtk_uartboot - 0.1.1
Using serial port: COM5
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0x8f29
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.10.0   (release):v2.10.0-mtk
NOTICE:  BL2: Built : 13:17:06, Mar  1 2024
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE:  Received FIP 0xba609 @ 0x40400000 ...
==================================

C:\3\mtk_uartboot-v0.1.1-x86_64-pc-windows-msvc>
full bootlog text from Putty 
ARP Retry count exceeded; starting again
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-r              ecovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; starting again
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-r              ecovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; starting again
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-r              ecovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; starting again
Wrong Image Format for bootm command
ERROR: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-r              ecovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *
Abort
Wrong Image Format for bootm command
ERROR: can't get kernel image!
MT7981> version
U-Boot 2024.01-OpenWrt-r26084-6e5edec159 (Apr 27 2024 - 21:44:48 +0000)

aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 13.2.0 r26084-6e5edec159) 13.2.0
GNU ld (GNU Binutils) 2.40.0
MT7981> nand info
'spi-nand0' is now active device
* spi-nand0
  - device: spi_nand@0
  - parent: spi@1100a000
  - driver: spi_nand
  - type: NAND flash
  - block size:        0x20000 bytes
  - page size:         0x800 bytes
  - OOB size:          64 bytes
  - OOB available:     24 bytes
  - 0x000000000000-0x000008000000 : "spi-nand0"
          - 0x000000000000-0x000000100000 : "bl2"
          - 0x000000100000-0x000000140000 : "Nvram"
          - 0x000000140000-0x000000180000 : "Bdata"
          - 0x000000180000-0x000000380000 : "factory"
          - 0x000000380000-0x000000580000 : "fip"
          - 0x000000580000-0x0000005c0000 : "crash"
          - 0x0000005c0000-0x000000600000 : "crash_log"
          - 0x000000600000-0x000007600000 : "ubi"
          - 0x000007600000-0x000007640000 : "KF"
MT7981>

I'm confused about how to proceed.

  • First of all, I want to save dumps from the original partitions. Which command can I use in "MT7981>"?
  • Secondly, please suggest how I can bypass the error in Putty and load the OpenWrt initramfs image? Maybe i should "3. format ubi and create new ubootenv volume"? Please advice.
332

Can you set up mesh between two rd03 on openwrt?

333

you can set up a mesh network between any routers that run on openwrt.