OpenWrt support for Xiaomi AX3000T

aloner · October 9, 2024, 4:56pm

Startup firmware 1 - same
Startup firmware 0:

 Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit
detect button reset released!
Reading from 0x0 to 0x4f7fdd7c, size 0x4 ... OK
Reading from 0x0 to 0x4f7fdd7c, size 0x4 ... OK
Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK
Writing to MTD device 'nmbm0'... OK
OK
[Dual Image] Booting System 0, sys1_failed = 2, sys2_failed = 3
ubi0: attaching mtd9
ubi0: scanning is finished
ubi0: attached mtd9 (name "ubi", size 34 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 1, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 10/5, WL threshold: 4096, image sequence number: 1858402101
ubi0: available PEBs: 214, total reserved PEBs: 58, PEBs reserved for bad PEB handling: 19
Reading from volume 'kernel' to 0x46000000, size 0x0 ... OK
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.6.54
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    4327381 Bytes = 4.1 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   9b27a44f
     Hash algo:    sha1
     Hash value:   d87cf0f98022c6e66a0e88e240287c412d312c71
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt xiaomi_mi-router-ax3000t device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46420a08
     Data Size:    23177 Bytes = 22.6 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   8aa95659
     Hash algo:    sha1
     Hash value:   56ea137f3010294f81f717095dec59dd1453935a
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x46420a08
   Uncompressing Kernel Image
   Loading Device Tree to 000000004f7f0000, end 000000004f7f8a88 ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.6.54 (builder@buildhost) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r27700-170ecbecfc) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Mon Oct  7 20:33:10 2024
[    0.000000] Machine model: Xiaomi Mi Router AX3000T
[    0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 KiB) map non-reusable ramoops@42ff0000
[    0.000000] OF: reserved mem: 0x0000000043000000..0x000000004302ffff (192 KiB) nomap non-reusable secmon@43000000
[    0.000000] OF: reserved mem: 0x0000000047c80000..0x0000000047d7ffff (1024 KiB) nomap non-reusable wmcpu-reserved@47c80000
[    0.000000] OF: reserved mem: 0x0000000047d80000..0x0000000047dbffff (256 KiB) nomap non-reusable wo-emi@47d80000
[    0.000000] OF: reserved mem: 0x0000000047dc0000..0x0000000047ffffff (2304 KiB) nomap non-reusable wo-data@47dc0000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x0000000047c7ffff]
[    0.000000]   node   0: [mem 0x0000000047c80000-0x0000000047ffffff]
[    0.000000]   node   0: [mem 0x0000000048000000-0x000000004fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.2
[    0.000000] percpu: Embedded 18 pages/cpu s35112 r8192 d30424 u73728
[    0.000000] pcpu-alloc: s35112 r8192 d30424 u73728 alloc=18*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyS0,115200n1 loglevel=8 swiotlb=512 rootfstype=squashfs firmware=0 mtd=ubi uart_en=1
[    0.000000] Unknown kernel command line parameters "firmware=0 mtd=ubi uart_en=1", will be passed to user space.
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64512
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: area num 2.
[    0.000000] software IO TLB: mapped [mem 0x000000004f900000-0x000000004fa00000] (1MB)
[    0.000000] Memory: 238724K/262144K available (8896K kernel code, 902K rwdata, 2588K rodata, 448K init, 302K bss, 23420K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv3: GICv3 features: 16 PPIs
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000076] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000085] pid_max: default: 32768 minimum: 301
[    0.002976] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.002984] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.005142] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.005676] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1.
[    0.005817] rcu: Hierarchical SRCU implementation.
[    0.005820] rcu:     Max phase no-delay instances is 1000.
[    0.006223] smp: Bringing up secondary CPUs ...
[    0.006589] Detected VIPT I-cache on CPU1
[    0.006634] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.006664] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.006731] smp: Brought up 1 node, 2 CPUs
[    0.006737] SMP: Total of 2 processors activated.
[    0.006741] CPU features: detected: 32-bit EL0 Support
[    0.006744] CPU features: detected: CRC32 instructions
[    0.006778] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.006781] CPU: All CPU(s) started at EL2
[    0.006782] alternatives: applying system-wide alternatives
[    0.010509] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.010526] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.011775] pinctrl core: initialized pinctrl subsystem
[    0.012884] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.013489] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.013516] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.013537] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.013904] thermal_sys: Registered thermal governor 'fair_share'
[    0.013908] thermal_sys: Registered thermal governor 'bang_bang'
[    0.013911] thermal_sys: Registered thermal governor 'step_wise'
[    0.013913] thermal_sys: Registered thermal governor 'user_space'
[    0.014019] ASID allocator initialised with 65536 entries
[    0.015059] pstore: Using crash dump compression: deflate
[    0.015065] pstore: Registered ramoops as persistent store backend
[    0.015067] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.022125] Modules: 29456 pages in range for non-PLT usage
[    0.022134] Modules: 520976 pages in range for PLT usage
[    0.022963] cryptd: max_cpu_qlen set to 1000
[    0.024098] SCSI subsystem initialized
[    0.024298] libata version 3.00 loaded.
[    0.025874] clocksource: Switched to clocksource arch_sys_counter
[    0.028159] NET: Registered PF_INET protocol family
[    0.028265] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.029517] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.029532] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.029541] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.029558] TCP bind hash table entries: 2048 (order: 4, 65536 bytes, linear)
[    0.029609] TCP: Hash tables configured (established 2048 bind 2048)
[    0.029683] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.029707] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.029973] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.030001] PCI: CLS 0 bytes, default 64
[    0.031439] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.036287] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.036295] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.069272] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.079617] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.083272] printk: console [ttyS0] disabled
[    0.103703] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 72, base_baud = 2500000) is a ST16650V2
[    0.103745] printk: console [ttyS0] enabled
[    0.852675] loop: module loaded
[    0.857761] spi-nand spi0.0: Winbond SPI NAND was found.
[    0.863075] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 96
[    0.871546] Signature found at block 1023 [0x07fe0000]
[    0.876694] NMBM configuration mismatch
[    0.880786] 10 fixed-partitions partitions found on MTD device spi0.0
[    0.887345] Creating 10 MTD partitions on "spi0.0":
[    0.892236] 0x000000000000-0x000000100000 : "BL2"
[    0.899458] 0x000000100000-0x000000140000 : "Nvram"
[    0.904914] 0x000000140000-0x000000180000 : "Bdata"
[    0.910422] 0x000000180000-0x000000380000 : "Factory"
[    0.917227] 0x000000380000-0x000000580000 : "FIP"
[    0.923385] 0x000000580000-0x0000005c0000 : "crash"
[    0.928906] 0x0000005c0000-0x000000600000 : "crash_log"
[    0.934732] 0x000007600000-0x000007640000 : "KF"
[    0.940005] 0x000000600000-0x000002800000 : "ubi_kernel"
[    0.963017] 0x000002800000-0x000007600000 : "ubi"
[    1.153277] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc081780000, irq 75
[    1.163011] i2c_dev: i2c /dev entries driver
[    1.169881] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    1.179015] NET: Registered PF_INET6 protocol family
[    1.184900] Segment Routing with IPv6
[    1.188624] In-situ OAM (IOAM) with IPv6
[    1.192585] NET: Registered PF_PACKET protocol family
[    1.197689] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.210877] 8021q: 802.1Q VLAN Support v1.8
[    1.309701] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[    1.318483] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.329490] mt7530-mdio mdio-bus:1f wan (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=80)
[    1.351672] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=81)
[    1.373708] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=82)
[    1.395726] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=83)
[    1.407309] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode
[    1.414062] DSA: tree 0 setup
[    1.417613] UBI: auto-attach mtd9
[    1.420938] ubi0: default fastmap pool size: 30
[    1.425457] ubi0: default fastmap WL pool size: 15
[    1.430258] ubi0: attaching mtd9
[    1.650097] ubi0: scanning is finished
[    1.658695] ubi0: attached mtd9 (name "ubi", size 78 MiB)
[    1.664098] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    1.670975] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    1.677757] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    1.684705] ubi0: good PEBs: 624, bad PEBs: 0, corrupted PEBs: 0
[    1.690702] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[    1.697915] ubi0: max/mean erase counter: 4/2, WL threshold: 4096, image sequence number: 1849223316
[    1.707035] ubi0: available PEBs: 598, total reserved PEBs: 26, PEBs reserved for bad PEB handling: 20
[    1.716336] ubi0: background thread "ubi_bgt0d" started, PID 616
[    1.716427] clk: Disabling unused clocks
[    1.727001] /dev/root: Can't open blockdev
[    1.731106] VFS: Cannot open root device "" or unknown-block(0,0): error -6
[    1.738071] Please append a correct "root=" boot option; here are the available partitions:
[    1.746423] 1f00            1024 mtdblock0
[    1.746429]  (driver?)
[    1.752944] 1f01             256 mtdblock1
[    1.752948]  (driver?)
[    1.759467] 1f02             256 mtdblock2
[    1.759472]  (driver?)
[    1.765991] 1f03            2048 mtdblock3
[    1.765995]  (driver?)
[    1.772510] 1f04            2048 mtdblock4
[    1.772513]  (driver?)
[    1.779032] 1f05             256 mtdblock5
[    1.779036]  (driver?)
[    1.785552] 1f06             256 mtdblock6
[    1.785556]  (driver?)
[    1.792075] 1f07             256 mtdblock7
[    1.792079]  (driver?)
[    1.798600] 1f08           34816 mtdblock8
[    1.798605]  (driver?)
[    1.805120] 1f09           79872 mtdblock9
[    1.805124]  (driver?)
[    1.811648] List of all bdev filesystems:
[    1.815643]  ext3
[    1.815645]  ext2
[    1.817562]  ext4
[    1.819475]  squashfs
[    1.821389]  f2fs
[    1.823649]
[    1.827044] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    1.835290] SMP: stopping secondary CPUs
[    1.839201] Kernel Offset: disabled
[    1.842675] CPU features: 0x0,00000000,00000000,1000400b
[    1.847974] Memory Limit: none
[    1.853329] pstore: backend (ramoops) writing error (-28)
[    1.858716] Rebooting in 1 seconds..

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024B [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):9548a30134d-dirty
NOTICE:  BL2: Built : 02:27:18, Jan 24 2024
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a003f1 000000ff 00100000 00000000
1001d040 | 00027e71 000200a0 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0xc
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 612, worse bit 0, min window 76
Window Sum 608, worse bit 8, min window 76
Window Sum 536, worse bit 4, min window 66
Window Sum 514, worse bit 15, min window 60
Window Sum 542, worse bit 3, min window 66
Window Sum 522, worse bit 15, min window 60
Window Sum 526, worse bit 15, min window 62
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):9548a30134d-dirty
NOTICE:  BL31: Built : 02:27:18, Jan 24 2024
NOTICE:  Hello BL31!!!
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000

Cthulhu88 · October 9, 2024, 5:11pm

From what I can see, OpenWrt is installed on firmware0, did you do these before sysupgrade?

nvram set flag_boot_rootfs=1
nvram set flag_last_success=1
nvram set flag_boot_success=1
nvram set flag_try_sys1_failed=0
nvram set flag_try_sys2_failed=0
nvram commit

It's now panicking when mounting the rootfs.

schmurtz · October 9, 2024, 10:02pm

Hi, After some experimentation with this model, here's what I concluded:

I think this is now difficult to buy an old version of this router, now the available versions are with firmware 1.0.84 which means that if you buy a AX3000T currently, it will be very probably not compatible with openWRT (no ethernet due to the new an8855 switch).

When you seriously brick the AX3000T with 1.0.84, currently it's not possible to restore even with a backup (there is a restore procedure which is working with mtk_uartboot but the current restore images doesn't have ethernet working and even with xmodem the restoration doesn't seems easy).

I have backuped the SPI of the AX3000T with 1.0.84 firmware out of box (never booted) thanks to NeoProgrammer, you'll find the backup here.

However restoring this SPI backup to my bricked device doesn't solve my bricked problem (I suppose that it requires to modify it with the right mac addresses but even after few tests it's not working properly).

If you are lucky and have an old version, it's not over yet: on my first router with 1.0.47 I have flashed ImmortalWrt (23.05-SNAPSHOT r27979-53e4ddfa7c), I use it only as wifi AP and there are routing problems (I have more than 40 wifi devices so it is highly solicited) on some devices I lost communication with the lan, rebooting the wireless interface solve the problem (which will come back few hours later). I will try to switch on another version later...

So globally I would not recommend this router for OpenWrt for now, that's a shame, it could be awesome but there is a big lack of maturity for now... May be it will be better in few months when Luci will be officially supported, with a better wifi stability and with the support of 1.0.84 and an8855 switch. But if you look for something reliable it doesn't seems to be a good deal for now.

Lexeyko · October 9, 2024, 10:19pm

Routers with 1.0.84 are restored via TFTP using factory firmware 1.0.84 without any problems.
Tested more than once.

schmurtz · October 9, 2024, 10:27pm

When I said "seriously bricked" I mean that I broke all the partitions, there is no TFTP possible anymore. But yes on a soft bricking you can still restore.

As you can see I don't receive any packet from the ethernet.

gssjshark · October 9, 2024, 10:49pm

How do we check what Ethernet switch we have on 1.0.84? Is there a command we can run to check?

Ser9ei · October 9, 2024, 11:48pm

Using the mtk_uartuboot method, absolute brick of the router with unsupported an8855 switch can be restored, because this way you only need

usb-uart adapter
stock uboot (get it from you backup)
stock firmware
head & hands

After running the stock uboot from ram memory by this method, you should stop boot and start tftp method to restore firmware.
But please remember, uboot is only in ram, and after every reboot - it will be lost uboot and needs to run mtk_uartboot method again to boot router.
After restoring the stock firmware - get ssh and install the stock uboot using the mtd utility.

PS
Looks difficult, but no nand programmer needed.

As for me this way faster then ‘NeoProgrammer’, as I remember, for burn 128MB spi-nand take ~25min and it's not include time and experience to solder / unsolder nand chip.

Cthulhu88 · October 10, 2024, 1:24am

You can check via dmesg: dmesg | grep -i an8855, but this is redundant; firmware 1.0.84 only works on hardware with the AN8855 switch.

Cthulhu88 · October 10, 2024, 1:29am

This is likely because you flashed OpenWrt U-Boot, which won't have mediatek's custom code for AN8855 (you still need a functional switch for TFTP to work).

To be fair, to get to this point, you tried really HARD to brick your device.

schmurtz · October 10, 2024, 1:58am

Thanks for these precious advice

The problem is that mtk_uartboot is crashing when I use BL2.bin uboot file from my backup

H:\Flash xiaomi AX3000T\repair\mtk_uartboot-v0.1.1-x86_64-pc-windows-msvc>mtk_uartboot -s COM3 --payload BL2.bin  --aarch64 --fip miwifi_rd03_firmware_f85f9_1.0.84.bin && putty.exe -serial COM3 -sercfg 115200,8,n,1,N
mtk_uartboot - 0.1.1
Using serial port: COM3
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
thread 'main' panicked at src\bootrom.rs:106:13:
send_da cmd status: 7442
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Edit: I tried with Bdata.bin instead of BL2.bin as payload it's not crashing but it's probably wrong...

I'm lost about which file to use.
For example I'm still not sure about the --fip (tried with miwifi_rd03_firmware_f85f9_1.0.84.bin which is stock firmware and FIP.bin from my backup without success)

Cthulhu88 · October 10, 2024, 2:22am

According to OpenWrt support for Xiaomi AX3000T - #860 by andi-at-1 you probably need https://github.com/981213/tf-a-mtk/releases/download/v2.10.0-mtk/bl2-mt7981-bga-ddr3-ram.bin

Ser9ei · October 10, 2024, 3:00am

u-boout (fip) - from your back;

about pre-loader (bl2):

And remember about:

schmurtz · October 10, 2024, 3:25am

This part is working:

mtk_uartboot -s COM3 --payload bl2-mt7981-bga-ddr3-ram.bin --aarch64 --fip FIP.bin && putty.exe -serial COM3 -sercfg 115200,8,n,1,N
mtk_uartboot - 0.1.1
Using serial port: COM3
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0x8f29
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.10.0   (release):v2.10.0-mtk
NOTICE:  BL2: Built : 13:17:06, Mar  1 2024
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE:  Received FIP 0x200000 @ 0x40400000 ...
==================================

But after that I systematically have:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024B [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):b18eebc1b35-dirty
NOTICE:  BL2: Built : 01:44:14, May 29 2024
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1302MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):b18eebc1b35-dirty
NOTICE:  BL31: Built : 01:44:14, May 29 2024
NOTICE:  Hello BL31!!!

Even with a large number of attempts it never ask for the itb file.

Lexeyko · October 10, 2024, 4:38am

I restored using the file openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip with exactly this name downloaded from the SNAPSHOT branch. Everything went quickly...

snake2903 · October 10, 2024, 6:58am

It's not difficult to buy older version...
I ordered two AX3000T (RD03) from AliExpress and i received 04.2024 devices with ESMT chip and 1.0.47 firmware. I got them yesterday so i didn't flash openWRT yet, but i will.

Lexeyko · October 10, 2024, 7:47am

This does not mean that if you order from this store today, you will also receive the "old" version of the router.

aloner · October 10, 2024, 8:59am

Yes, I did that. What do I need to do to get the router up and running?

erayrafet · October 10, 2024, 4:16pm

Switch to Immortal's Uboot, problem solved.

Cthulhu88 · October 10, 2024, 4:21pm

I assume you were replying to my post? I don't know how to solve the kernel panic when mounting your rootfs, my suggestion would be to restore to factory, either via http://bigota.miwifi.com/xiaoqiang/tools/MIWIFIRepairTool.x86.zip or https://openwrt.org/inbox/toh/xiaomi/ax3000t#tftp_instructions_for_the_stock_bootloader

Once back to stock firmware, enable ssh again and follow these this time around: https://openwrt.org/inbox/toh/xiaomi/ax3000t#change_to_openwrt_u-boot

schmurtz · October 11, 2024, 6:46am

Yes it is, I have ordered a first one from aliexpress, I received 1.0.47 firmware, then ordered a second one from the same seller, I received 1.0.84, then ordered from another seller and received again 1.0.84.
So yes there are probably some sellers with old stock and it is probably possible to identify them with the mac adress printed on the box, but no, it's not "easy" to get one.