OpenWrt support for Xiaomi AX3000T

For Developers
3493

First of all, greetings to the community for being so helpful.

I own 3 AX3000T all with Foresee NAND and AN8855 network, two of them run flawlessly with OpenWRT 24.10.0 but the third one became slow and unstable from the beggining and finally got bricked.
First times I tryed using the MiRepairTool but always get the same results, static orange LED.
Made some deep search and found that there are some bad blocks, at this point I have started to work on the NAND Foresee way where it reached the "System halt!" with no LED ligth after did the nand erase.force command.

I have followed these steps from @Lotoss connecting through UART mode and I am able to run the web interface after launching the iniramfs-kernel from RAM; however it is not able to do the System upgrade neither using browser or command since it results in "System halt!" every time it tries to do the firmware update.

Below is the debug for the "kernel image write" and "launch bootm" commands:

Summary

MT7981> tftpboot 0x46000000 openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-kernel.bin
Using ethernet@15100000 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-kernel.bin'.
Load address: 0x46000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#######################################################
2.8 MiB/s
done
Bytes transferred = 10341260 (9dcb8c hex)
MT7981> bootm 0x46000000

Loading kernel from FIT Image at 46000000 ...

Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-6.6.87
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000e8
Data Size: 4299370 Bytes = 4.1 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x48000000
Entry Point: 0x48000000
Hash algo: crc32
Hash value: c8a8e3fe
Hash algo: sha1
Hash value: 124ed844dba1516a2963b5d4bee7c3a7f7e05cad
Verifying Hash Integrity ... crc32+ sha1+ OK

Loading ramdisk from FIT Image at 46000000 ...

Using 'config-1' configuration
Trying 'initrd-1' ramdisk subimage
Description: ARM64 OpenWrt xiaomi_mi-router-ax3000t initrd
Type: RAMDisk Image
Compression: uncompressed
Data Start: 0x46419c98
Data Size: 6011528 Bytes = 5.7 MiB
Architecture: AArch64
OS: Linux
Load Address: unavailable
Entry Point: unavailable
Hash algo: crc32
Hash value: b7770540
Hash algo: sha1
Hash value: 15e179ed4de65ed72fbe0943c12acbe94fc7e0e4
Verifying Hash Integrity ... crc32+ sha1+ OK

Loading fdt from FIT Image at 46000000 ...

Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt xiaomi_mi-router-ax3000t device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x469d5834
Data Size: 28183 Bytes = 27.5 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: 87981bfb
Hash algo: sha1
Hash value: 22a62a37dcdb409d2e732a514bced10a222d0ba0
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x469d5834
Working FDT set to 469d5834
Uncompressing Kernel Image to 48000000
Loading Ramdisk to 4e214000, end 4e7cfa88 ... OK
Loading Device Tree to 000000004e20a000, end 000000004e213e16 ... OK
Working FDT set to 4e20a000
Add 'ramoops@42ff0000' node failed: FDT_ERR_EXISTS

Starting kernel ...

<6>[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
<5>[ 0.000000] Linux version 6.6.87 (runner@fv-az1374-240) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r0-c552c8a) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Fri Apr 18 13:52:34 2025
<6>[ 0.000000] Machine model: Xiaomi Mi Router AX3000T
<6>[ 0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 KiB) map non-reusable ramoops@42ff0000
<6>[ 0.000000] OF: reserved mem: 0x0000000043000000..0x000000004302ffff (192 KiB) nomap non-reusable secmon@43000000
<6>[ 0.000000] OF: reserved mem: 0x0000000047c80000..0x0000000047d7ffff (1024 KiB) nomap non-reusable wmcpu-reserved@47c80000
<6>[ 0.000000] OF: reserved mem: 0x0000000047d80000..0x0000000047dbffff (256 KiB) nomap non-reusable wo-emi@47d80000
<6>[ 0.000000] OF: reserved mem: 0x0000000047dc0000..0x0000000047ffffff (2304 KiB) nomap non-reusable wo-data@47dc0000
<6>[ 0.000000] Zone ranges:
<6>[ 0.000000] DMA [mem 0x0000000040000000-0x000000004fffffff]
<6>[ 0.000000] DMA32 empty
<6>[ 0.000000] Normal empty
<6>[ 0.000000] Movable zone start for each node
<6>[ 0.000000] Early memory node ranges
<6>[ 0.000000] node 0: [mem 0x0000000040000000-0x0000000042ffffff]
<6>[ 0.000000] node 0: [mem 0x0000000043000000-0x000000004302ffff]
<6>[ 0.000000] node 0: [mem 0x0000000043030000-0x0000000047c7ffff]
<6>[ 0.000000] node 0: [mem 0x0000000047c80000-0x0000000047ffffff]
<6>[ 0.000000] node 0: [mem 0x0000000048000000-0x000000004fffffff]
<6>[ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fffffff]
<6>[ 0.000000] psci: probing for conduit method from DT.
<6>[ 0.000000] psci: PSCIv1.1 detected in firmware.
<6>[ 0.000000] psci: Using standard PSCI v0.2 function IDs
<6>[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
<6>[ 0.000000] psci: SMC Calling Convention v1.5
<6>[ 0.000000] percpu: Embedded 18 pages/cpu s35048 r8192 d30488 u73728
<7>[ 0.000000] pcpu-alloc: s35048 r8192 d30488 u73728 alloc=184096
<7>[ 0.000000] pcpu-alloc: [0] 0 [0] 1
<6>[ 0.000000] Detected VIPT I-cache on CPU0
<6>[ 0.000000] CPU features: detected: GIC system register CPU interface
<6>[ 0.000000] CPU features: kernel page table isolation disabled by kernel configuration
<6>[ 0.000000] alternatives: applying boot alternatives
<5>[ 0.000000] Kernel command line: console=ttyS0,115200n8 console_msg_format=syslog
<6>[ 0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
<6>[ 0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
<6>[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 64512
<6>[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
<6>[ 0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB
<6>[ 0.000000] software IO TLB: area num 2.
<6>[ 0.000000] software IO TLB: SWIOTLB bounce buffer size roundup to 0MB
<6>[ 0.000000] software IO TLB: mapped [mem 0x000000004fe41000-0x000000004fec1000] (0MB)
<6>[ 0.000000] Memory: 233280K/262144K available (8832K kernel code, 994K rwdata, 2568K rodata, 448K init, 289K bss, 28864K reserved, 0K cma-reserved)
<6>[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
<6>[ 0.000000] rcu: Hierarchical RCU implementation.
<6>[ 0.000000] rcu: RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
<6>[ 0.000000] Tracing variant of Tasks RCU enabled.
<6>[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
<6>[ 0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
<6>[ 0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
<6>[ 0.000000] GICv3: GIC: Using split EOI/Deactivate mode
<6>[ 0.000000] GICv3: 640 SPIs implemented
<6>[ 0.000000] GICv3: 0 Extended SPIs implemented
<6>[ 0.000000] Root IRQ handler: gic_handle_irq
<6>[ 0.000000] GICv3: GICv3 features: 16 PPIs
<6>[ 0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
<6>[ 0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
<6>[ 0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
<6>[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
<6>[ 0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
<6>[ 0.000076] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
<6>[ 0.000084] pid_max: default: 32768 minimum: 301
<6>[ 0.003020] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
<6>[ 0.003027] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
<4>[ 0.005187] cacheinfo: Unable to detect cache hierarchy for CPU 0
<6>[ 0.005725] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
<6>[ 0.005875] rcu: Hierarchical SRCU implementation.
<6>[ 0.005878] rcu: Max phase no-delay instances is 1000.
<6>[ 0.006327] smp: Bringing up secondary CPUs ...
<6>[ 0.006697] Detected VIPT I-cache on CPU1
<6>[ 0.006742] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
<6>[ 0.006771] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
<6>[ 0.006839] smp: Brought up 1 node, 2 CPUs
<6>[ 0.006844] SMP: Total of 2 processors activated.
<6>[ 0.006847] CPU features: detected: 32-bit EL0 Support
<6>[ 0.006851] CPU features: detected: CRC32 instructions
<6>[ 0.006884] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
<6>[ 0.006887] CPU: All CPU(s) started at EL2
<6>[ 0.006888] alternatives: applying system-wide alternatives
<6>[ 0.010925] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
<6>[ 0.010943] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
<6>[ 0.012206] pinctrl core: initialized pinctrl subsystem
<6>[ 0.013365] NET: Registered PF_NETLINK/PF_ROUTE protocol family
<6>[ 0.013714] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
<6>[ 0.013739] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
<6>[ 0.013760] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
<6>[ 0.014167] thermal_sys: Registered thermal governor 'fair_share'
<6>[ 0.014171] thermal_sys: Registered thermal governor 'bang_bang'
<6>[ 0.014174] thermal_sys: Registered thermal governor 'step_wise'
<6>[ 0.014176] thermal_sys: Registered thermal governor 'user_space'
<6>[ 0.014249] ASID allocator initialised with 65536 entries
<6>[ 0.014983] pstore: Using crash dump compression: deflate
<6>[ 0.014988] pstore: Registered ramoops as persistent store backend
<6>[ 0.014991] ramoops: using 0x10000@0x42ff0000, ecc: 0
<6>[ 0.016756] /soc/interrupt-controller@c000000: Fixed dependency cycle(s) with /soc/interrupt-controller@c000000
<6>[ 0.022440] Modules: 29440 pages in range for non-PLT usage
<6>[ 0.022448] Modules: 520960 pages in range for PLT usage
<6>[ 0.023419] cryptd: max_cpu_qlen set to 1000
<5>[ 0.025512] SCSI subsystem initialized
<7>[ 0.025699] libata version 3.00 loaded.
<6>[ 0.027275] clocksource: Switched to clocksource arch_sys_counter
<6>[ 0.029585] NET: Registered PF_INET protocol family
<6>[ 0.029683] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
<6>[ 0.030815] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
<6>[ 0.030830] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
<6>[ 0.030839] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
<6>[ 0.030857] TCP bind hash table entries: 2048 (order: 4, 65536 bytes, linear)
<6>[ 0.030909] TCP: Hash tables configured (established 2048 bind 2048)
<6>[ 0.031223] MPTCP token hash table entries: 256 (order: 0, 6144 bytes, linear)
<6>[ 0.031337] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
<6>[ 0.031353] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
<6>[ 0.031550] NET: Registered PF_UNIX/PF_LOCAL protocol family
<6>[ 0.031573] PCI: CLS 0 bytes, default 64
<6>[ 0.031791] Unpacking initramfs...
<6>[ 0.038262] workingset: timestamp_bits=46 max_order=16 bucket_order=0
<6>[ 0.042999] squashfs: version 4.0 (2009/01/31) Phillip Lougher
<6>[ 0.043008] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
<6>[ 0.109963] Serial: 8250/16550 driver, 3 ports, IRQ sharing disabled
<6>[ 0.111001] printk: console [ttyS0] disabled
<6>[ 0.131307] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 72, base_baud = 2500000) is a ST16650V2
<6>[ 0.131349] printk: console [ttyS0] enabled
<6>[ 0.926630] loop: module loaded
<4>[ 0.932818] spi-nand spi0.0: calibration failed, fallback to default: 0x2
<6>[ 0.940066] spi-nand spi0.0: FORESEE SPI NAND was found.
<6>[ 0.945640] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
<3>[ 1.670744] Signature not found
<6>[ 1.744966] Freeing initrd memory: 5868K
<5>[ 1.758505] 10 fixed-partitions partitions found on MTD device spi0.0
<5>[ 1.765214] Creating 10 MTD partitions on "spi0.0":
<5>[ 1.770355] 0x000000000000-0x000000100000 : "BL2"
<5>[ 1.776272] 0x000000100000-0x000000140000 : "Nvram"
<5>[ 1.782438] 0x000000140000-0x000000180000 : "Bdata"
<5>[ 1.788188] 0x000000180000-0x000000380000 : "Factory"
<5>[ 1.795189] 0x000000380000-0x000000580000 : "FIP"
<5>[ 1.801634] 0x000000580000-0x0000005c0000 : "crash"
<5>[ 1.807383] 0x0000005c0000-0x000000600000 : "crash_log"
<5>[ 1.813448] 0x000007600000-0x000007640000 : "KF"
<5>[ 1.818900] 0x000000600000-0x000002800000 : "ubi_kernel"
<5>[ 1.837298] random: crng init done
<5>[ 1.844983] 0x000002800000-0x000007600000 : "ubi"
<3>[ 2.018993] mtk_soc_eth 15100000.ethernet: generated random MAC address 65:74:68:25:64:00
<6>[ 2.381672] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc081380000, irq 75
<6>[ 2.391716] i2c_dev: i2c /dev entries driver
<6>[ 2.398849] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
<6>[ 2.408226] NET: Registered PF_INET6 protocol family
<6>[ 2.414572] Segment Routing with IPv6
<6>[ 2.418546] In-situ OAM (IOAM) with IPv6
<6>[ 2.422780] NET: Registered PF_PACKET protocol family
<6>[ 2.428272] 8021q: 802.1Q VLAN Support v1.8
<3>[ 3.466524] mt7530-mdio mdio-bus:1f: reset timeout
<4>[ 3.471605] mt7530-mdio: probe of mdio-bus:1f failed with error -110
<6>[ 3.806686] an8855-switch an8855-switch.2.auto: configuring for fixed/2500base-x link mode
<6>[ 3.831309] an8855-switch an8855-switch.2.auto: Link is Up - 2.5Gbps/Full - flow control rx/tx
<6>[ 3.909200] an8855-switch an8855-switch.2.auto wan (uninitialized): PHY [mdio_an8855-1:01] driver [Airoha AN8855 internal PHY] (irq=POLL)
<6>[ 3.979173] an8855-switch an8855-switch.2.auto lan2 (uninitialized): PHY [mdio_an8855-1:02] driver [Airoha AN8855 internal PHY] (irq=POLL)
<6>[ 4.069177] an8855-switch an8855-switch.2.auto lan3 (uninitialized): PHY [mdio_an8855-1:03] driver [Airoha AN8855 internal PHY] (irq=POLL)
<6>[ 4.159193] an8855-switch an8855-switch.2.auto lan4 (uninitialized): PHY [mdio_an8855-1:04] driver [Airoha AN8855 internal PHY] (irq=POLL)
<6>[ 4.173498] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode
<6>[ 4.180527] DSA: tree 0 setup
<3>[ 4.184237] UBI error: no valid UBI magic found inside mtd9
<6>[ 4.190210] clk: Disabling unused clocks
<6>[ 4.194987] Freeing unused kernel memory: 448K
<6>[ 4.199765] Run /init as init process
<7>[ 4.203677] with arguments:
<7>[ 4.206892] /init
<7>[ 4.209464] with environment:
<7>[ 4.212853] HOME=/
<7>[ 4.215461] TERM=linux
<14>[ 4.410007] init: Console is alive
<14>[ 4.413875] init: - watchdog -
<14>[ 4.426210] kmodloader: loading kernel modules from /etc/modules-boot.d/
<4>[ 4.435753] gpio_button_hotplug: loading out-of-tree module taints kernel.
<14>[ 4.445813] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
<14>[ 4.460156] init: - preinit -
<6>[ 4.570000] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
<6>[ 4.578737] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
<6>[ 4.592169] an8855-switch an8855-switch.2.auto lan4: configuring for phy/internal link mode
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
<14>[ 8.738095] procd: - early -
<14>[ 8.741387] procd: - watchdog -
<14>[ 9.269898] procd: - watchdog -
<14>[ 9.273555] procd: - ubus -
<14>[ 9.427620] procd: - init -
Please press Enter to activate this console.
<14>[ 9.627150] kmodloader: loading kernel modules from /etc/modules.d/*
<6>[ 9.645877] l2tp_core: L2TP core driver, V2.0
<6>[ 9.652518] l2tp_netlink: L2TP netlink interface
<6>[ 9.660086] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
<6>[ 9.675523] Loading modules backported from Linux version v6.12.6-0-ge9d65b48ce1a
<6>[ 9.683299] Backport generated by backports.git v6.1.110-1-35-g410656ef04d2
<14>[ 9.817118] urngd: v1.0.2 started.
<6>[ 10.051837] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20240823161240a
<6>[ 10.051837]
<6>[ 10.074350] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20240823161304
<6>[ 10.114652] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20240823161841
<4>[ 10.211694] mt798x-wmac 18000000.wifi: eeprom load fail, use default bin
<4>[ 10.218739] mt798x-wmac 18000000.wifi: Direct firmware load for mediatek/mt7981_eeprom_mt7976_dbdc.bin failed with error -2
<4>[ 10.230129] mt798x-wmac 18000000.wifi: Falling back to sysfs fallback for: mediatek/mt7981_eeprom_mt7976_dbdc.bin
<4>[ 10.266410] mt798x-wmac: probe of 18000000.wifi failed with error -12
<6>[ 10.314649] PPP generic driver version 2.4.2
<6>[ 10.320235] NET: Registered PF_PPPOX protocol family
<6>[ 10.327547] wireguard: WireGuard 1.0.0 loaded. See www.wireguard.com for information.
<6>[ 10.335633] wireguard: Copyright (C) 2015-2019 Jason A. Donenfeld Jason@zx2c4.com. All Rights Reserved.
<6>[ 10.346645] l2tp_ppp: PPPoL2TP kernel driver, V2.0
<14>[ 10.354622] kmodloader: done loading kernel modules from /etc/modules.d/*
<4>[ 11.472362] mtdblock: MTD device 'Bdata' is NAND, please consider using UBI block devices instead.
<6>[ 17.902142] mtk_soc_eth 15100000.ethernet eth0: Link is Down
<6>[ 17.918732] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
<6>[ 17.930647] an8855-switch an8855-switch.2.auto lan2: configuring for phy/internal link mode
<6>[ 17.931354] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
<6>[ 17.944345] br-lan: port 1(lan2) entered blocking state
<6>[ 17.953661] br-lan: port 1(lan2) entered disabled state
<6>[ 17.959201] an8855-switch an8855-switch.2.auto lan2: entered allmulticast mode
<6>[ 17.966685] mtk_soc_eth 15100000.ethernet eth0: entered allmulticast mode
<6>[ 17.985103] an8855-switch an8855-switch.2.auto lan2: entered promiscuous mode
<6>[ 18.009810] an8855-switch an8855-switch.2.auto lan3: configuring for phy/internal link mode
<6>[ 18.020365] br-lan: port 2(lan3) entered blocking state
<6>[ 18.025861] br-lan: port 2(lan3) entered disabled state
<6>[ 18.031433] an8855-switch an8855-switch.2.auto lan3: entered allmulticast mode
<6>[ 18.043639] an8855-switch an8855-switch.2.auto lan3: entered promiscuous mode
<6>[ 18.060212] an8855-switch an8855-switch.2.auto lan4: configuring for phy/internal link mode
<6>[ 18.070838] br-lan: port 3(lan4) entered blocking state
<6>[ 18.076333] br-lan: port 3(lan4) entered disabled state
<6>[ 18.081931] an8855-switch an8855-switch.2.auto lan4: entered allmulticast mode
<6>[ 18.094546] an8855-switch an8855-switch.2.auto lan4: entered promiscuous mode
<6>[ 18.118321] an8855-switch an8855-switch.2.auto wan: configuring for phy/internal link mode
<6>[ 22.167810] an8855-switch an8855-switch.2.auto lan3: Link is Up - 1Gbps/Full - flow control rx/tx
<6>[ 22.167835] br-lan: port 2(lan3) entered blocking state
<6>[ 22.182423] br-lan: port 2(lan3) entered forwarding state

Here is the debug for the sysupgrade.bin launched from browser:

Summary

root@OpenWrt:~# Watchdog handover: fd=3

  • watchdog -
    Watchdog does not have CARDRESET support
    Thu Jan 1 00:03:07 GMT 1970 upgrade: Sending TERM to remaining processes ...
    Thu Jan 1 00:03:07 GMT 1970 upgrade: Sending signal TERM to netifd (1748)
    Thu Jan 1 00:03:11 GMT 1970 upgrade: Sending KILL to remaining processes ...
    Thu Jan 1 00:03:11 GMT 1970 upgrade: Sending signal KILL to netifd (1748)
    <6>[ 199.879175] stage2 (3437): drop_caches: 3
    ubidetach: error!: cannot detach mtd9
    error 19 (No such device)
    ubiformat: mtd9 (nand), size 81788928 bytes (78.0 MiB), 624 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
    libscan: scanning eraseblock 623 -- 100 % complete
    ubiformat: 624 eraseblocks are supposedly empty
    ubiformat: formatting eraseblock 623 -- 100 % complete
    ubidetach: error!: cannot detach mtd8
    error 19 (No such device)
    ubiformat: mtd8 (nand), size 35651584 bytes (34.0 MiB), 272 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
    libscan: scanning eraseblock 271 -- 100 % complete
    ubiformat: 272 eraseblocks are supposedly empty
    ubiformat: formatting eraseblock 271 -- 100 % complete
    failed to access u-boot-env. skip env setup.
    Thu Jan 1 00:03:28 GMT 1970 upgrade: Switching to ramdisk...
    Thu Jan 1 00:03:29 UTC 1970 upgrade: Performing system upgrade...
    verifying sysupgrade tar file integrity
    <5>[ 209.469443] ubi0: default fastmap pool size: 10
    <5>[ 209.474236] ubi0: default fastmap WL pool size: 5
    <5>[ 209.479324] ubi0: attaching mtd8
    <5>[ 209.578393] ubi0: scanning is finished
    <5>[ 209.586983] ubi0: attached mtd8 (name "ubi_kernel", size 34 MiB)
    <5>[ 209.593268] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
    <5>[ 209.600397] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
    <5>[ 209.607438] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
    <5>[ 209.614647] ubi0: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
    <5>[ 209.620905] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
    <5>[ 209.628376] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 170510419
    <5>[ 209.637669] ubi0: available PEBs: 246, total reserved PEBs: 26, PEBs reserved for bad PEB handling: 20
    <5>[ 209.647227] ubi0: background thread "ubi_bgt0d" started, PID 4181
    UBI device number 0, total 272 LEBs (34537472 bytes, 32.9 MiB), available 246 LEBs (31236096 bytes, 29.7 MiB), LEB size 126976 bytes (124.0 KiB)
    <5>[ 209.682954] ubi1: default fastmap pool size: 30
    <5>[ 209.687777] ubi1: default fastmap WL pool size: 15
    <5>[ 209.692817] ubi1: attaching mtd9
    <5>[ 209.918381] ubi1: scanning is finished
    <5>[ 209.927410] ubi1: attached mtd9 (name "ubi", size 78 MiB)
    <5>[ 209.933073] ubi1: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
    <5>[ 209.940212] ubi1: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
    <5>[ 209.947246] ubi1: VID header offset: 2048 (aligned 2048), data offset: 4096
    <5>[ 209.954459] ubi1: good PEBs: 624, bad PEBs: 0, corrupted PEBs: 0
    <5>[ 209.960717] ubi1: user volume: 0, internal volumes: 1, max. volumes count: 128
    <5>[ 209.968189] ubi1: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 200680046
    <5>[ 209.977483] ubi1: available PEBs: 598, total reserved PEBs: 26, PEBs reserved for bad PEB handling: 20
    <5>[ 209.987042] ubi1: background thread "ubi_bgt1d" started, PID 4205
    UBI device number 1, total 624 LEBs (79233024 bytes, 75.5 MiB), available 598 LEBs (75931648 bytes, 72.4 MiB), LEB size 126976 bytes (124.0 KiB)
    Volume ID 0, size 35 LEBs (4444160 bytes, 4.2 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "kernel", alignment 1
    <6>[ 210.049851] block ubiblock1_0: created from ubi1:0(rootfs)
    <5>[ 210.055600] ubiblock: device ubiblock1_0 (rootfs) set to be root filesystem
    Volume ID 0, size 51 LEBs (6475776 bytes, 6.1 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs", alignment 1
    Set volume size to 69455872
    Volume ID 1, size 547 LEBs (69455872 bytes, 66.2 MiB), LEB size 126976 bytes (124.0 KiB), dynamic, name "rootfs_data", alignment 1
    sysupgrade successful
    umount: can't unmount /dev: Resource busy
    umoun<0>[ 212.930110] reboot: Restarting system
    t: can't unmount
    F0: 102B 0000
    FA: 1040 0000
    FA: 1040 0000 [0200]
    F9: 3903 0041
    F3: 1001 0000 [0200]
    F3: 1001 0000
    F6: 102C 0000
    F5: 480A 0031
    00: 1005 0000
    FA: 1040 0000
    FA: 1040 0000 [0200]
    F9: 3903 0041
    F3: 1001 0000 [0200]
    F3: 1001 0000
    F6: 102C 0000
    01: 102A 0001
    02: 1005 0000
    BP: 2000 00C0 [0001]
    EC: 0000 0000 [1000]
    T0: 0000 00ED [010F]
    System halt!

If someone could help it would be very pleased.

Adding some extra points, I tryed using the most recent files from new patch for Foresee + Bad Block either for the mtk_uartboot, mt7981 and system upgrade as well.

Many thanks in advance

1 Like
3494

If your AX3000T router has Foresee NAND with bad blocks, and you want to install a Test Build PR #17963 that supports bad block handling, you must first erase the NAND flash via mtk_uartboot:

MT7981> nand erase.force 0x0 0x8000000

Only after you clean up your Foresee NAND from false-positive and real bad blocks (and after restoring erased stock partitions from your own backup), you can install the patched (custom) version of OpenWrt, so that your bad blocks will be properly handled during installation.
See details in the GitHub thread and also see the post from @Lotoss (MAIN PART -> MAIN PART of MAIN PART):

MT7981> tftpboot 0x46000000 BL2.bin
nand write 0x46000000 0x0 0x100000
tftpboot 0x46000000 FIP.bin
nand write 0x46000000 0x380000 0x200000
tftpboot 0x46000000 Nvram.bin
nand write 0x46000000 0x100000 0x40000
tftpboot 0x46000000 Bdata.bin
nand write 0x46000000 0x140000 0x40000
tftpboot 0x46000000 Factory.bin
nand write 0x46000000 0x180000 0x200000

tftpboot 0x46000000 openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-kernel.bin

bootm 0x46000000

Once OpenWrt is loaded in initramfs system mode, install the sysupgrade file openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin via Luci.

4 Likes
3495

I'm about to buy a couple of the AX3000T RD23 (International) routers. So I assume I will get it with 1.0.92 which I will need to downgrade to 1.0.76 first.
Can I ask what tool I use for the downgrade? Is it either PIXSvr or MIWifiRepair tool? Not much info on how to do it with PIXSvr, so hoping I can use the MIWifiRepair tool which has some info here: https://www.androidpimp.com/wireless-routers/xiaomi-ax3000t-router/
Thanks!

3496

All the steps from @Lotoss (MAIN PART -> MAIN PART of MAIN PART) are being done but I wasn't aware of needing to do a backup first so there isn't own backup and I have been using the one provided in FAQ.zip from same Lotoss.

Let me point that router won't boot by itself, no LED lights nor debug information after powering up. Have been reading a bit more on system halt and could be due to boot fully erased on NAND, could it be?

At this point, is there any chance to keep trying to fix it or how can I check contents on NAND to verify what have been erased?

3497

Not necessarily, Amazon DE still sells 1.0.55 RD23. Perform the initial router configuration w/o connecting to the internet. The router will upgrade to version 1.0.92 if you connect the internet to the WAN port.

You can downgrade via the stock out the box Xiaomi interface, see details in the Wiki. The MiWiFi repair tool also works well for downgrading, see instructions here. The stock firmware can be found in the Wiki.

2 Likes
3498

It means you've lost your MAC addresses and individual router calibrations. It's always a good idea to back up the stock partitions first before installing OpenWrt, now you know). You can still try restoring the MAC addresses manually later, or use a backup from one of your another routers.

Seems like you fully wiped out your NAND flash and didn’t restore the partitions after nand erase.force command.

Try connecting again using mtk_uartboot. If it connects, there's still hope for recovery (see details also here):

  • download tftpd64.464.zip and unzip it;
  • place all the required files into the unzipped tftpd64.464 folder: BL2.bin, FIP.bin, Nvram.bin, Bdata.bin, Factory.bin, openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-kernel.bin
  • repeat all the steps with nand erase.force and tftpboot+nand write commands. Please make sure tftpboot is indeed transferring files to the router and not blocked by firewall (read the terminal output in console).

Good luck with restoring your partitions!
Let us know how it goes. For further discussion and help requests, I suggest you create a separate topic + provide console outputs with your commands.

3499

Ouch, it was so simple as properly restore the backup. Just tried again but paying attention to every step for the tftpbood and nand write where should be done separately while I was doing it by pairs so only tftpboot command were run skipping the nand write part. Now it shows the nand write successful after each command so the backup can be properly restored into nand.

Once loaded the kernel.bin and launched bootm it has been able to upgrade firmware with sysupgrade using browser and after rebooting no more "System halt!" resulting in system boot from nand.

Maybe it is a good idea to point that in the instructions from @Lotoss or add the expected result for every command as it's showing in your post to ensure no mistakes due to copy&paste double lines.

The below could be an example:

Prepare the tftpd enviroment

setenv ipaddr 192.168.1.1

setenv serverip 192.168.1.100

Erase the nand

nand erase.force 0x0 0x8000000

Expected output for nand erase
(note here is a clean nand erase since badblocks has been treatened before)

'spi-nand0' is now active device
Erasing from 0x0 to 0x7ffffff, size 0x8000000 ...
Succeeded

Load backup for BL2

tftpboot 0x46000000 BL2.bin

Expected output for backup loaded

Using ethernet@15100000 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename 'BL2.bin'.
Load address: 0x46000000
Loading: T #################################################################
         #######
         190.4 KiB/s
done
Bytes transferred = 1048576 (100000 hex)

Write backup to nand

nand write 0x46000000 0x0 0x100000

Expected output for nand write

Writing from 0x0 to 0xfffff, size 0x100000 ...
Succeeded

I will consider writing a separate topic with all steps and learnings to make it easier for new cases.

You helped a lot, many thanks!

5 Likes
3500

Thank you! I got it working (it was a missing wpad-openssl package). More details can be found here as well if anyone else struggles with a similar issue.

1 Like
3501

Hi, I am on version 1.90 and I don't manage to downgrade. I tried modifying the downgrade settings at the end of url to 0, then 2 -- but it always say file is corrupted. After cliciking ignore, it says it is loading the update - but 5 minutes go by- and my session just locks itself.

What can I try ? I suspect they might be reading package metadate to see if'ts official or something

3502

MiWiFi Repair Tool?

1 Like
3503

I am using Linux so this isn't really an option. I shouldn't have updated to 1.90 lol.

Is anyone experiencing the same issue? Are the tricks mentioned in the wiki not working anymore

3504

I would like to test swap rd03 (CN) -> rd23 (INT). Can someone share with me FIP and BL2 mtd backup (from rd23 device with AN8855 switch)?

3505

You can use dnsmasq to recover it using Linux. See instructions for Xiaomi AX3200 below, it should be the same for AX3000T.

3506

Okay, seems the post above about the AX3200 has the instructions :slight_smile:

Hey,
could someone please help me with flashing the router?

I got it open and connected UART. I'm on Nixos so pakcaged the mtk_uart tool and ran it.

What should be done now?

/nix/store/ya1k5ragq1vyh7m5vhil5q91wps50995-mtk_uartboot-0.1.1/bin/mtk_uartboot -s /dev/ttyUSB0 --payload bl2-mt7981-bga-ddr3-ram.bin  --aarch64 --fip openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip
mtk_uartboot - 0.1.1
Using serial port: /dev/ttyUSB0
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0x8f29
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.10.0	(release):v2.10.0-mtk
NOTICE:  BL2: Built : 13:17:06, Mar  1 2024
NOTICE:  WDT: [40000000] Software reset (reboot)
NOTICE:  EMI: Using DDR3 settings
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE:  Received FIP 0xe0a39 @ 0x40400000 ...
==================================

Should screen be run after it finishes? Like the case with Putty.exe && putty.exe -serial COM5 -sercfg 115200,8,n,1,N

What about the next step tftpd64.exe? Just setup static IP address and launch tftpd-hpa? Connect the router directly to the machine running server?

3507

Going in circles.

So setup the Ethernet interface to static IP:

27: enp195s0f3u1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether 9c:bf:0d:00:86:80 brd ff:ff:ff:ff:ff:ff
    altname enx9cbf0d008680
    inet 192.168.1.254/24 brd 192.168.1.255 scope global secondary noprefixroute enp195s0f3u1
       valid_lft forever preferred_lft forever
    inet6 fe80::82b6:6265:ee33:78a3/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

When I run the mtk_uart it goes up then down again.

In the meantime the tftp is running:

sudo dnsmasq --no-daemon --bind-interfaces --interface=enp195s0f3u1 --enable-tftp --tftp-root=/tmp/tftp --log-queries
dnsmasq: started, version 2.91 cachesize 150
dnsmasq: compile time options: IPv6 GNU-getopt DBus no-UBus no-i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset nftset auth DNSSEC loop-detect inotify dumpfile
dnsmasq-tftp: TFTP root is /tmp/tftp  
dnsmasq: reading /etc/resolv.conf
dnsmasq: using nameserver 10.12.99.1#53
dnsmasq: read /etc/hosts - 5 names

ls /tmp/tftp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb 
/tmp/tftp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb

Nothing on the interface if I check wireshark.

3508

Your dnsmasq must provide an IP address to the router via DHCP. See the --dhcp-range=192.168.31.1,192.168.31.99 in the AX3200 page.

3509

Hello, I just got an AX3000T RD03 with Airoha switch and Foresee nand.
Regarding the bad blocks warning on the wiki:

Warning! Don't brick your router!
There is 1% probability that devices with the Foresee NAND flash chip can be shipped from factory with remapped Bad Blocks.

Is there no way to test for bad blocks in advance, from exploited stock firmware, or do they only show up after those blocks fail being erased by openwrt ubi format?

3510

The information is not entirely correct. Should be:

Warning! Don't brick your router!
There is 1% probability that devices with the Foresee NAND flash chip will be bricked during vanilla OpenWrt installation due to pseudo Bad Blocks appearance. Reason: 02H or 32H must be used to reset cache buffer before using 84H or 34H.

P.S. All NAND flash chip can be shipped from factory with remapped Bad Blocks. And that's ok.

3511

But the question still stands, is there any way to check for remapped bad blocks from stock firmware? From serial boot log? From nowhere at all and a brick it's just pure chance if you reformat the nand during openwrt installation?

Maybe I'm misunderstanding something...
Are there some (99%?) devices with Foresee nand with no bad blocks and some (1%?) with bad blocks. And only those 1% devices will brick?
Or all devices with Foresee nand will have a 1% chance of bricking when openwrt is installed regardless of nand having bad blocks or not?

3512

nanddump output shows bad blocks.

Quite so.

1 Like