Oh I'm not suggesting you pushed this 23.05.4 release, I'm just very surprised it even exists.
I cannot find the May 23 commit by @hauke
I opened one of the brickers, seems that there is other hardware build in.
Soc: Mediatek MT7981BA
Ram: Winbond W632GU6QB-11
Flash: Winbond 25n01kvzeir
Mabe openwrt build is incompatible and immortalwrt has some fallback still inside? Or are the partitions different?
Here is the output of full info from xmir patcher:
Summary
MTD_partitions:
0 > addr: 00000000 size: 08000000 ro: 0 name: "spi0.0"
1 > addr: 00000000 size: 00100000 ro: 0 name: "BL2"
2 > addr: 00100000 size: 00040000 ro: 0 name: "Nvram"
3 > addr: 00140000 size: 00040000 ro: 0 name: "Bdata"
4 > addr: 00180000 size: 00200000 ro: 0 name: "Factory"
5 > addr: 00380000 size: 00200000 ro: 0 name: "FIP"
6 > addr: 00580000 size: 00040000 ro: 0 name: "crash"
7 > addr: 005C0000 size: 00040000 ro: 0 name: "crash_log"
8 > addr: 00600000 size: 02200000 ro: 0 name: "ubi"
9 > addr: 02800000 size: 02200000 ro: 0 name: "ubi1"
10 > addr: 04A00000 size: 02000000 ro: 0 name: "overlay"
11 > addr: 06A00000 size: 00C00000 ro: 0 name: "data"
12 > addr: 07600000 size: 00040000 ro: 0 name: "KF"
Base_info:
Linux version: 5.4.171
CPU arch: arm64
CPU name: mt7981
SPI rom: False
Kernel_command_line:
console=ttyS0,115200n1
loglevel=8
swiotlb=512
rootfstype=squashfs
firmware=1
mtd=ubi1
uart_en=1
NVRam_params:
CountryCode=CN
Router_unconfigured=0
SN=49850/F4QT26054
arch=arm
baudrate=115200
boot_auto=bootxq
boot_fw0=run boot_rd_img;bootm
boot_fw1=run boot_rd_img2;bootm
boot_rd_img=nand read ${loadaddr} 0x2C0000 2000;image_blks 2048;nand read ${loadaddr} 0x2C0000 ${img_align_size}
boot_rd_img2=nand read ${loadaddr} 0x20C0000 2000;image_blks 2048;nand read ${loadaddr} 0x20C0000 ${img_align_size}
boot_wait=on
bootargs=console=ttyS0,115200n1 loglevel=8 swiotlb=512 rootfstype=squashfs firmware=1 mtd=ubi1 uart_en=1
bootcmd=bootxq
bootdelay=3
bootmenu_0=Startup system (Default)=bootxq
bootmenu_1=Startup firmware0=bootxq 0
bootmenu_2=Startup firmware1=bootxq 1
bootmenu_3=Upgrade firmware=mtkupgrade fw
bootmenu_4=Upgrade ATF BL2=mtkupgrade bl2
bootmenu_5=Upgrade ATF FIP=mtkupgrade fip
bootmenu_6=Upgrade single image=mtkupgrade simg
bootmenu_7=Load image=mtkload
bootmenu_delay=5
color=101
ethaddr=44:f7:70:2c:26:ec
ethaddr_wan=50:88:11:57:09:bb
ethaddr_wan2=44:f7:70:2c:26:ed
ethprime=eth1
fdt_high=0x6c000000
fdtcontroladdr=4ffc4910
flag_boot_rootfs=1
flag_boot_success=1
flag_boot_type=2
flag_last_success=1
flag_ota_reboot=0
flag_try_sys1_failed=0
flag_try_sys2_failed=0
invaild_env=no
ipaddr=192.168.10.1
loadaddr=0x46000000
mode=Router
model=RD03
mtdids=nmbm0=nmbm0
mtdparts=nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),2048k(factory),2048k(fip),256k(crash),256k(crash_log),34816k(ubi),34816k(ubi1),32768k(overlay),12288k(data),256k(KF)
no_wifi_dev_times=0
pcbasn=515DMID03M05/1010811960-00283
rand_key=+d5ZLlTrZmIrh0MCmx6aEXbUo0AHqXS5qvDO9dzqpphmz6M6QwXK4w==
rand_nonce=0F515II9uPvIFV61A1NUHVlh/oQpZY75UZcievUq5UACgo7iaGrc5a6flzDTAIECZ7x2n0SJxyywFFjWV8wxcegWFbgZPIr2UvecFazhqxraGHTu7XMK+vSDxyq8dEsrvwkpRPaKCvnCR2N8yXJjFjsIovTsxaTG+FzfR8YdPwZfr1OJbY9wOs61OYkFJdxU9JRTcVcgFrgsAzSwcisf3U1tD5oJzmRu2wsIgzY16KVKWh3OvrFfIerFwFvwzR49m2HeGJ8jV91mhkU8CPzRQYyGtmWsrMGF2I5oULwderrCLr+M+5FahFti3gU+wnDQVH8gIwmiQS4ULbaLJWLoqTzr4QL6tTHzabG6CXB8SSKKD1yLhEmqj9KBGT1CHPxpuv9tp9y4cec0NNh2XZM+KnkiROfZlz9KhQA2uca+ld8EoxkCLITpXbW1A/2/Slu7ADSoWdmihDrl10hh5K2n2Z1MYe9q0SYfqYpvztiipUwOZvx+H/DrSYhkjrNPHnwoCZjvV0g9yVOBNeHlMOHAbUmdtzYbT6FztLN91xwmJN5Ou1FSZnTzXpI8TyoPlBjW+KrF/DrTbiqj1q+fUTzPkWTGMaWL2wn5y7/J6Hc4Om5RYZMAMXarTXAk07hfEHZIZSSb8s0GXACSwm1IAad429q7WNbyV6Cx5QAmrb4E6+tpBjPx7GX4kCmZMFDSwyRKjb8ZZMVzlz3MPzp1ulJnykUl3+fGd55n25vJvf1KnBvrUyc2Qn4YEW38SDZLL4pS8PWIQv7mwdGtd0+OZmEgijxXfX/GMZuRL84T8ky8uBVEuw9+r7aoWmQGefgjW+HQR1RMx9d2U11swkxuFyed2eAyJ0cNx/Lg5cplaJq8j60+tJdirxrZNq6ErtcOcDBVvrXvwjySo/y3D0x62hVjxvkP29fhH/KSD5TQY+R4Fdyfe29+mJ8Dmcr0caQZr6wThqBsapac/u78ajYbIfZOK9QlLTYpkTogZvu8j/dU5kI7EG1CKg/G5vH1mTgVXtd7RVFHXsI9d9ebkVRGrlcmz+1kFqZXl3jsx9Jx4Rg5pnLRf4ydeb+owsOjxhwGq8sfDVoXdumxVBSVNHcnMz+x1Oz0+nzUMKfqwFBxVr+3LcNUhyzM192LQyhm2HD+l/6dDb9WCmp47ITIVHFP0hJ8DlVwF/3DQHU8w8arX3DRse/IpMs2L12nKVo/qDMDDTlBxGcVxKMUllIXv0KLcSW+Kaxci9FH/3yd3oIbhNz8cVCkOcRfNsdS6Im8wo8WDH3afijf2aSE6J/gnfJRm0o/aXWQAiCoieDVwunhf7Ph1sDMK6u9mafYTEmfFZX5Mf13Zu4XN5bd0xFRhYDdm1OH/w==
restore_defaults=0
serverip=192.168.10.100
ssh_en=1
stderr=serial@11002000
stdin=serial@11002000
stdout=serial@11002000
telnet_en=0
uart_en=1
wl0_radio=1
wl0_ssid=rd03_minet_09bb
wl1_radio=1
wl1_ssid=rd03_minet_09bb
RootFS_current:
num = 1
mtd_num = None
mtd_dev = "None"
partition = "None"
Version_info:
UBoot: None
OpenWrt: unknown
Firmware: 1.0.47
Channel: release
BuildTime: Sun, 30 Jul 2023 07:08:05 +0000
Hardware: RD03
UBoot(2): 2022.04-rc1
Bootloader_info:
BL2:
addr: 0x00000000
size: 0x00100000
image size: 80 bytes
type: None
FIP:
addr: 0x00380000
size: 0x00200000
image size: 26972 bytes
type: None
ENV_info:
Nvram:
addr: 0x00100000
size: 0x00010000
len: 3153 bytes
prefix: b'\x18\xadx\xee'
CountryCode=CN
Router_unconfigured=0
SN=49850/F4QT26054
arch=arm
baudrate=115200
boot_auto=bootxq
boot_fw0=run boot_rd_img;bootm
boot_fw1=run boot_rd_img2;bootm
boot_rd_img=nand read ${loadaddr} 0x2C0000 2000;image_blks 2048;nand read ${loadaddr} 0x2C0000 ${img_align_size}
boot_rd_img2=nand read ${loadaddr} 0x20C0000 2000;image_blks 2048;nand read ${loadaddr} 0x20C0000 ${img_align_size}
boot_wait=on
bootargs=console=ttyS0,115200n1 loglevel=8 swiotlb=512 rootfstype=squashfs firmware=1 mtd=ubi1 uart_en=1
bootcmd=bootxq
bootdelay=3
bootmenu_0=Startup system (Default)=bootxq
bootmenu_1=Startup firmware0=bootxq 0
bootmenu_2=Startup firmware1=bootxq 1
bootmenu_3=Upgrade firmware=mtkupgrade fw
bootmenu_4=Upgrade ATF BL2=mtkupgrade bl2
bootmenu_5=Upgrade ATF FIP=mtkupgrade fip
bootmenu_6=Upgrade single image=mtkupgrade simg
bootmenu_7=Load image=mtkload
bootmenu_delay=5
color=101
ethaddr=44:f7:70:2c:26:ec
ethaddr_wan=50:88:11:57:09:bb
ethaddr_wan2=44:f7:70:2c:26:ed
ethprime=eth1
fdt_high=0x6c000000
fdtcontroladdr=4ffc4910
flag_boot_rootfs=1
flag_boot_success=1
flag_boot_type=2
flag_last_success=1
flag_ota_reboot=0
flag_try_sys1_failed=0
flag_try_sys2_failed=0
invaild_env=no
ipaddr=192.168.10.1
loadaddr=0x46000000
mode=Router
model=RD03
mtdids=nmbm0=nmbm0
mtdparts=nmbm0:1024k(bl2),256k(Nvram),256k(Bdata),2048k(factory),2048k(fip),256k(crash),256k(crash_log),34816k(ubi),34816k(ubi1),32768k(overlay),12288k(data),256k(KF)
no_wifi_dev_times=0
pcbasn=515DMID03M05/1010811960-00283
rand_key=+d5ZLlTrZmIrh0MCmx6aEXbUo0AHqXS5qvDO9dzqpphmz6M6QwXK4w==
rand_nonce=0F515II9uPvIFV61A1NUHVlh/oQpZY75UZcievUq5UACgo7iaGrc5a6flzDTAIECZ7x2n0SJxyywFFjWV8wxcegWFbgZPIr2UvecFazhqxraGHTu7XMK+vSDxyq8dEsrvwkpRPaKCvnCR2N8yXJjFjsIovTsxaTG+FzfR8YdPwZfr1OJbY9wOs61OYkFJdxU9JRTcVcgFrgsAzSwcisf3U1tD5oJzmRu2wsIgzY16KVKWh3OvrFfIerFwFvwzR49m2HeGJ8jV91mhkU8CPzRQYyGtmWsrMGF2I5oULwderrCLr+M+5FahFti3gU+wnDQVH8gIwmiQS4ULbaLJWLoqTzr4QL6tTHzabG6CXB8SSKKD1yLhEmqj9KBGT1CHPxpuv9tp9y4cec0NNh2XZM+KnkiROfZlz9KhQA2uca+ld8EoxkCLITpXbW1A/2/Slu7ADSoWdmihDrl10hh5K2n2Z1MYe9q0SYfqYpvztiipUwOZvx+H/DrSYhkjrNPHnwoCZjvV0g9yVOBNeHlMOHAbUmdtzYbT6FztLN91xwmJN5Ou1FSZnTzXpI8TyoPlBjW+KrF/DrTbiqj1q+fUTzPkWTGMaWL2wn5y7/J6Hc4Om5RYZMAMXarTXAk07hfEHZIZSSb8s0GXACSwm1IAad429q7WNbyV6Cx5QAmrb4E6+tpBjPx7GX4kCmZMFDSwyRKjb8ZZMVzlz3MPzp1ulJnykUl3+fGd55n25vJvf1KnBvrUyc2Qn4YEW38SDZLL4pS8PWIQv7mwdGtd0+OZmEgijxXfX/GMZuRL84T8ky8uBVEuw9+r7aoWmQGefgjW+HQR1RMx9d2U11swkxuFyed2eAyJ0cNx/Lg5cplaJq8j60+tJdirxrZNq6ErtcOcDBVvrXvwjySo/y3D0x62hVjxvkP29fhH/KSD5TQY+R4Fdyfe29+mJ8Dmcr0caQZr6wThqBsapac/u78ajYbIfZOK9QlLTYpkTogZvu8j/dU5kI7EG1CKg/G5vH1mTgVXtd7RVFHXsI9d9ebkVRGrlcmz+1kFqZXl3jsx9Jx4Rg5pnLRf4ydeb+owsOjxhwGq8sfDVoXdumxVBSVNHcnMz+x1Oz0+nzUMKfqwFBxVr+3LcNUhyzM192LQyhm2HD+l/6dDb9WCmp47ITIVHFP0hJ8DlVwF/3DQHU8w8arX3DRse/IpMs2L12nKVo/qDMDDTlBxGcVxKMUllIXv0KLcSW+Kaxci9FH/3yd3oIbhNz8cVCkOcRfNsdS6Im8wo8WDH3afijf2aSE6J/gnfJRm0o/aXWQAiCoieDVwunhf7Ph1sDMK6u9mafYTEmfFZX5Mf13Zu4XN5bd0xFRhYDdm1OH/w==
restore_defaults=0
serverip=192.168.10.100
ssh_en=1
stderr=serial@11002000
stdin=serial@11002000
stdout=serial@11002000
telnet_en=0
uart_en=1
wl0_radio=1
wl0_ssid=rd03_minet_09bb
wl1_radio=1
wl1_ssid=rd03_minet_09bb
Bdata:
addr: 0x00140000
size: 0x00010000
len: 1774 bytes
prefix: b'\x89\x9e\xbb\xe5'
rand_key=+d5ZLlTrZmIrh0MCmx6aEXbUo0AHqXS5qvDO9dzqpphmz6M6QwXK4w==
rand_nonce=0F515II9uPvIFV61A1NUHVlh/oQpZY75UZcievUq5UACgo7iaGrc5a6flzDTAIECZ7x2n0SJxyywFFjWV8wxcegWFbgZPIr2UvecFazhqxraGHTu7XMK+vSDxyq8dEsrvwkpRPaKCvnCR2N8yXJjFjsIovTsxaTG+FzfR8YdPwZfr1OJbY9wOs61OYkFJdxU9JRTcVcgFrgsAzSwcisf3U1tD5oJzmRu2wsIgzY16KVKWh3OvrFfIerFwFvwzR49m2HeGJ8jV91mhkU8CPzRQYyGtmWsrMGF2I5oULwderrCLr+M+5FahFti3gU+wnDQVH8gIwmiQS4ULbaLJWLoqTzr4QL6tTHzabG6CXB8SSKKD1yLhEmqj9KBGT1CHPxpuv9tp9y4cec0NNh2XZM+KnkiROfZlz9KhQA2uca+ld8EoxkCLITpXbW1A/2/Slu7ADSoWdmihDrl10hh5K2n2Z1MYe9q0SYfqYpvztiipUwOZvx+H/DrSYhkjrNPHnwoCZjvV0g9yVOBNeHlMOHAbUmdtzYbT6FztLN91xwmJN5Ou1FSZnTzXpI8TyoPlBjW+KrF/DrTbiqj1q+fUTzPkWTGMaWL2wn5y7/J6Hc4Om5RYZMAMXarTXAk07hfEHZIZSSb8s0GXACSwm1IAad429q7WNbyV6Cx5QAmrb4E6+tpBjPx7GX4kCmZMFDSwyRKjb8ZZMVzlz3MPzp1ulJnykUl3+fGd55n25vJvf1KnBvrUyc2Qn4YEW38SDZLL4pS8PWIQv7mwdGtd0+OZmEgijxXfX/GMZuRL84T8ky8uBVEuw9+r7aoWmQGefgjW+HQR1RMx9d2U11swkxuFyed2eAyJ0cNx/Lg5cplaJq8j60+tJdirxrZNq6ErtcOcDBVvrXvwjySo/y3D0x62hVjxvkP29fhH/KSD5TQY+R4Fdyfe29+mJ8Dmcr0caQZr6wThqBsapac/u78ajYbIfZOK9QlLTYpkTogZvu8j/dU5kI7EG1CKg/G5vH1mTgVXtd7RVFHXsI9d9ebkVRGrlcmz+1kFqZXl3jsx9Jx4Rg5pnLRf4ydeb+owsOjxhwGq8sfDVoXdumxVBSVNHcnMz+x1Oz0+nzUMKfqwFBxVr+3LcNUhyzM192LQyhm2HD+l/6dDb9WCmp47ITIVHFP0hJ8DlVwF/3DQHU8w8arX3DRse/IpMs2L12nKVo/qDMDDTlBxGcVxKMUllIXv0KLcSW+Kaxci9FH/3yd3oIbhNz8cVCkOcRfNsdS6Im8wo8WDH3afijf2aSE6J/gnfJRm0o/aXWQAiCoieDVwunhf7Ph1sDMK6u9mafYTEmfFZX5Mf13Zu4XN5bd0xFRhYDdm1OH/w==
pcbasn=515DMID03M05/1010811960-00283
color=101
CountryCode=CN
ethaddr_wan=50:88:11:57:09:bb
ethaddr=44:f7:70:2c:26:ec
ethaddr_wan2=44:f7:70:2c:26:ed
SN=49850/F4QT26054
model=RD03
miot_did=aiLHXnXVng6r5wkRN51TCA==
miot_key=2ddl5/g84t/hbFnajz2YIA==
wl1_ssid=rd03_minet_09bb
wl0_ssid=rd03_minet_09bb
telnet_en=0
ssh_en=0
uart_en=0
BL2:
addr: 0x00060000
size: 0x000A0000
len: 0 bytes
prefix: b'\xff\xff\xff\xff'
Here is the kernel log from the stock firmware:
Here is the kernel log from a working immortalwrt Initram, lots of errors for module loading:
The diff NAND chip , need openwrt to cover it. How to confirm this from outside.
I have now upgraded from snapshot to the current stable release - OpenWrt 23.05.4.
I also updated the OpenWrt U-Boot as a precaution.
However, after making the changes in /etc/config/wireless, I noticed that there are now 4 radios instead of 2!
Should the two new radios be configured as well?
change 'platform/soc/18000000.wifi' to 'platform/18000000.wifi' in your old wifis
Delete the new entrys
Do a reload_config
1 Like
Heureka 
There is absolutely nothing different at the outside what i see, but you can light your torch through the bottom and then you can read 'winbond' or 'esmt' on the chip
Its located at the right - middle - edge of the pcb (debug port is left)
But why is that no problem for immortalwrt?
immortawrt and x-wrt has this patch to support Winbond 25n01kvzeir .
2 Likes
This is very important before user flash openwrt, should add a warnning on the top of
https://openwrt.org/inbox/toh/xiaomi/ax3000t
The official openwrt does not have this patch. Hope someone PR it asap.
Ok should i open an issue for that
Just came to say thanks to all, specially remittor, for all the work on this router. Bought an AX3000T from AliExpress at 38€, I asked for the EU version but came with an US plug (luckily I have an adapter) and the CN version of the router, with firmware 1.0.47 pre-installed which made everything simpler. Xmir Patcher was giving some SSH timeout errors on reboot and backup commands (the router was rebooting on it's own) but the flashing went without a problem.
Now onto configuring it!
6 Likes
I also now have 2 devices:
One worked with the official openwrt files as stated here: https://openwrt.org/inbox/toh/xiaomi/ax3000t
1 just arrived this week and there I thought I bricked it because after following the manual it failed to boot (led stayed orange, sometimes became whitish but no connection could be made)
- I recovered the 1.47 firmware using Mi Fixtool from Windows
- Then I flashed immortalwrt instead of openwrt builds and then it worked.
If somebody needs further information let me know.
Hey Guys! Just got a 3000T and I've been trying to change it to OpenWRT.
Unfortunately I can barely leave step one - Im on version .47 of the original firmware and the exploit seems to work (SSH is not immediatelly refused), but Im unable to log into the router. It asks for a password. None of the passwords i've tried work, I'm starting to think I should just bruteforce it somehow, but this might take a loooong time.
CN version. No idea which internals it has.
Xmir patcher asks for the password you entered for wifi. I dunno whats the root pw, but you can change it with xmir patcher. (But just use it to flash, makes your life easier).
Be sure to have the ESMT flash chip, if you spot a Winbond logo go with immortalwrt for now
Hello. Is Xiaomi supplying new hardware version of AX3000T? I got a new CN version and get it soft-bricked.
Firmware version is 1.47, I successfully ssh into it and then flash a third-party uboot. The uboot works as it used to be on my one another AX3000T, then I flash a squash sysupgrade and it bricked. I opened it and connect to the console via UART:
- Load offical SNAPSHOT initramfs-factory via TFTP, version r26993-74879140a1, kernel dont load mtk_soc_eth, "ip link show" shows loopback interface ONLY.
- Load immortalwrt SNAPSHOT initramfs-factory, version r27916-a0528c71e2, kernel loads mtk_soc_eth and network goes up, I can log into web interface. "cat /proc/mtd" shows NAND layout like this:
dev: size erasesize name
mtd0: 00100000 00020000 "BL2"
mtd1: 00040000 00020000 "Nvram"
mtd2: 00040000 00020000 "Bdata"
mtd3: 00200000 00020000 "Factory"
mtd4: 00200000 00020000 "FIP"
mtd5: 00040000 00020000 "crash"
mtd6: 00040000 00020000 "crash_log"
mtd7: 00040000 00020000 "KF"
mtd8: 02200000 00020000 "ubi_kernel"
mtd9: 04800000 00020000 "ubi"
- In immortalwrt SNAPSHOT, I flash the same version of squashfs sysupgrade, and unfortunately kernel panic with error like this:
[ 1.325400] UBI: auto-attach mtd9
[ 1.328738] ubi0: default fastmap pool size: 30
[ 1.333277] ubi0: default fastmap WL pool size: 15
[ 1.338056] ubi0: attaching mtd9
[ 1.771975] ubi0 error: scan_peb: bad image sequence number 1090802509 in PEB 528, expected 1721205160
[ 1.781298] Erase counter header dump:
[ 1.785041] magic 0x55424923
[ 1.788778] version 1
[ 1.791732] ec 8
[ 1.794692] vid_hdr_offset 2048
[ 1.797907] data_offset 4096
[ 1.801122] image_seq 1090802509
[ 1.804863] hdr_crc 0x60def4ee
[ 1.808600] erase counter header hexdump:
[ 1.812598] 00000000: 55 42 49 23 01 00 00 00 00 00 00 00 00 00 00 08 00 00 08 00 00 00 10 00 41 04 53 4d 00 00 00 00 UBI#....................A.SM....
[ 1.826144] 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 de f4 ee ............................`...
[ 1.839785] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd9, error -22
[ 1.846880] UBI error: cannot attach mtd9
[ 1.851136] clk: Disabling unused clocks
[ 1.855818] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[ 1.863320] Please append a correct "root=" boot option; here are the available partitions:
......
[ 1.936916] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
for me root password was root
can it be that WED doesnt work with 23.05.4 build?
i added the option "options mt7915e wed_enable=Y" and rebooted ofc
Soft and Hardware offloading are enbebled
cat /sys/module/mt7915e/parameters/wed_enable returns Y
but i still see over 30% CPU Load on a iperf test with 360mbit/s Speed
Do you have packet steering switched on and irqbalance running?