Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision Next revisionBoth sides next revision | ||
| inbox:toh:xiaomi:ax3000t [2023/12/11 17:36] – Created from the form at meta:create_new_device_page dimfishr | inbox:toh:xiaomi:ax3000t [2024/10/05 17:49] – [Table] vladshulakov | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Xiaomi AX3000T ====== | ====== Xiaomi AX3000T ====== | ||
| - | ~~NOTOC~~ | ||
| - | /* This template is intended to be used via https:// | + | <WRAP center round important 60%> |
| + | **Warning!** Don't brick your router! | ||
| - | {{page> | + | AX3000T routers come with either '' |
| - | //Write a short, relevant description of the device. Include a technical overview, but avoid marketing buzzwords/ | + | </WRAP> |
| - | /*****/ | + | <WRAP center round important 60%> |
| - | /* How to add images ========> | + | New AX3000T devices with stock firmware version 1.0.84 or newer have received updated hardware ([[https://forum.openwrt.org/t/ |
| - | /*****/ | + | |
| - | {{ media: | + | </ |
| + | The Xiaomi AX3000T router supports 2 802.11ax streams on both 2.4GHz @40MHz and 5GHz @160MHz for a combined 3000Mbps wireless speed. It is based on the MediaTek MT7981 SoC. | ||
| - | ===== OpenWrt support ===== | + | There are two versions of the Xiaomi AX3000T router: |
| + | * model **RD03**: Chinese version | ||
| + | * model **RD23**: International (Global) version. | ||
| + | Both versions have exactly the same hardware, and the only difference is the version of the stock firmware (which is region-locked). | ||
| - | <color red> | + | {{media: |
| + | **Support Forums** https:// | ||
| - | /*** if info available: uncomment | + | There are 2 known OpenWrt installation methods for the Xiaomi AX3000T: |
| - | ===== Supporting activities ===== | + | * **API RCE method**: the method involves executing shell commands on the stock router firmware to enable SSH access by exploiting the API RCE, either in '' |
| - | //Describe if there are any ongoing activities that might lead to OpenWrt support.// | + | * **UART flash method**: the method which requires opening the device, connecting a UART cable, |
| - | * OpenWrt forum thread: (add link) | + | OpenWrt Support Status: |
| - | ***/ | + | ^ Stock Firmware ver. |
| + | | 1.0.31 (INT) | RD23 | '' | ||
| + | | 1.0.49 (INT) | RD23 | '' | ||
| + | | 1.0.47 | ||
| + | | 1.0.64 (CN) | RD03 | '' | ||
| + | | 1.0.84 (CN) | RD03 | '' | ||
| + | * *note: devices with the '' | ||
| - | /*** if info available: uncomment and fill in | ||
| - | ===== Experimental firmware ===== | ||
| - | //List experimental firmware download links here.// | + | ===== Supported Versions ===== |
| - | //None at this time.// | + | <!-- ToH: { |
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } --> | ||
| - | * External image (add link) | ||
| - | * trunk image (add link) | ||
| - | * ... | ||
| - | ***/ | ||
| + | ===== Hardware Highlights ===== | ||
| + | <!-- ToH: { | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | } --> | ||
| - | ===== Hardware highlights ===== | ||
| - | ^ CPU ^ Ram ^ Flash ^ Network | ||
| - | | EXAMPLE RT3052 @ 384 MHz | ||
| + | ===== Installation===== | ||
| - | /*** if info available: uncomment and fill in | + | ==== Flash instructions |
| - | ===== Installation ===== | + | <WRAP center round info 60%> |
| - | - → [[:downloads|Obtain firmware]] | + | Besides the manual steps outlined below, there is the [[https:// |
| - | | + | </ |
| - | - → [[: | + | |
| - | ==== Installing OpenWrt | + | 1. Get ssh access. |
| - | ***/ | + | #!/bin/sh |
| + | |||
| + | if [ $# -ne 2 ]; then | ||
| + | cat << | ||
| + | Usage: $0 [misystem | xqsystem] [stok] | ||
| + | e.g. $0 misystem e6ea114ba2cddb0c70fbbc417bb2706c | ||
| + | Copy the stok-string from a browser' | ||
| + | EOF | ||
| + | exit 1 | ||
| + | fi | ||
| + | |||
| + | [ -z " | ||
| + | |||
| + | url=" | ||
| + | |||
| + | case " | ||
| + | misystem) | ||
| + | url=" | ||
| + | pre="open=1&model=1&level=" | ||
| + | suf="" | ||
| + | ;; | ||
| + | xqsystem) | ||
| + | url=" | ||
| + | pre=" | ||
| + | suf="'" | ||
| + | ;; | ||
| + | | ||
| + | echo " | ||
| + | ;; | ||
| + | esac | ||
| + | |||
| + | curl -X POST " | ||
| + | sleep 1 | ||
| + | curl -X POST " | ||
| + | sleep 1 | ||
| + | curl -X POST " | ||
| + | sleep 1 | ||
| + | curl -X POST " | ||
| + | sleep 1 | ||
| + | curl -X POST " | ||
| + | 2. Backup stock partitions | ||
| + | |||
| + | ssh -o StrictHostKeyChecking=no -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa -v root@192.168.31.1 | ||
| + | nanddump -f / | ||
| + | nanddump -f / | ||
| + | nanddump -f / | ||
| + | nanddump -f / | ||
| + | nanddump -f / | ||
| + | nanddump -f / | ||
| + | nanddump -f /tmp/KF.bin /dev/mtd12 | ||
| + | |||
| + | Then transfer them to your computer in a safe place. | ||
| + | |||
| + | To copy you can run netcat on your computer (in this case the computer' | ||
| + | |||
| + | $ netcat -l 1234 | tar xvf - | ||
| + | |||
| + | And send the data from the router: | ||
| + | |||
| + | root@XiaoQiang: | ||
| + | |||
| + | |||
| + | 3. Get firmware information: | ||
| + | |||
| + | 4. Copy openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-initramfs-factory.ubi to **/tmp** and flash | ||
| + | |||
| + | * If **firmware=0** | ||
| + | |||
| + | ubiformat /dev/mtd9 -y -f / | ||
| + | nvram set boot_wait=on | ||
| + | nvram set uart_en=1 | ||
| + | nvram set flag_boot_rootfs=1 | ||
| + | nvram set flag_last_success=1 | ||
| + | nvram set flag_boot_success=1 | ||
| + | nvram set flag_try_sys1_failed=0 | ||
| + | nvram set flag_try_sys2_failed=0 | ||
| + | nvram commit | ||
| + | reboot | ||
| + | |||
| + | * If **firmware=1** | ||
| + | |||
| + | ubiformat /dev/mtd8 -y -f / | ||
| + | nvram set boot_wait=on | ||
| + | nvram set uart_en=1 | ||
| + | nvram set flag_boot_rootfs=0 | ||
| + | nvram set flag_last_success=0 | ||
| + | nvram set flag_boot_success=1 | ||
| + | nvram set flag_try_sys1_failed=0 | ||
| + | nvram set flag_try_sys2_failed=0 | ||
| + | nvram commit | ||
| + | reboot | ||
| + | |||
| + | Once the router is rebooted, it should boot to the OpenWrt initramfs system now. To be sure to use one of OpenWrt' | ||
| + | |||
| + | Note that you should configure the computer' | ||
| + | This command will connect you to the OpenWrt system: | ||
| + | |||
| + | ssh root@192.168.1.1 | ||
| + | |||
| + | |||
| + | 5. Copy openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin to **/tmp** and flash: | ||
| + | sysupgrade -n / | ||
| + | |||
| + | |||
| + | ==== Change to OpenWrt U-Boot ==== | ||
| + | <WRAP info> Default available router space is **60Mb**. It's possible to increase this size by replacing stock bootloader with the OpenWrt U-Boot bootloader. Please [[https:// | ||
| + | OpenWrt U-Boot provides faster boot loading and more space: **75Mb** (with recovery) or **85Mb** (without recovery). | ||
| + | </ | ||
| + | |||
| + | 1. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-factory.ubi | ||
| + | ubiformat /dev/mtd8 -y -f / | ||
| + | |||
| + | reboot | ||
| + | |||
| + | 2. Install kmod-mtd-rw | ||
| + | opkg update && opkg install kmod-mtd-rw | ||
| + | |||
| + | insmod mtd-rw i_want_a_brick=1 | ||
| + | |||
| + | 3. Format ubi and create new ubootenv volume | ||
| + | ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8 | ||
| + | ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB | ||
| + | ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB | ||
| + | |||
| + | 4. *(Optional **-10Mb** free space) Add recovery boot feature.* | ||
| + | ubimkvol /dev/ubi0 -n 2 -N recovery -s 10MiB | ||
| + | ubiupdatevol /dev/ubi0_2 / | ||
| + | |||
| + | 5. Flash Openwrt U-Boot | ||
| + | mtd write / | ||
| + | mtd write / | ||
| + | |||
| + | 6. Flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb | ||
| + | sysupgrade -n / | ||
| + | |||
| + | ==== Go Back to stock from Openwrt U-Boot ==== | ||
| + | |||
| + | 1. Force flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb | ||
| + | sysupgrade -F -n / | ||
| + | |||
| + | 2. Format ubi and Nvram | ||
| + | ubidetach -p /dev/mtd8; ubiformat /dev/mtd8 -y; ubiattach -p /dev/mtd8 | ||
| + | mtd erase Nvram | ||
| + | |||
| + | 3. Install kmod-mtd-rw | ||
| + | opkg update && opkg install kmod-mtd-rw | ||
| + | |||
| + | insmod mtd-rw i_want_a_brick=1 | ||
| + | |||
| + | 4. Flash stock images from backup | ||
| + | mtd write / | ||
| + | mtd write / | ||
| + | mtd write / | ||
| + | |||
| + | Then reboot your router, waiting it finished rollback in minutes. | ||
| + | |||
| + | ==== Go Back to stock firmware from stock bootloader ==== | ||
| + | ubiformat /dev/mtd8 -y -f / | ||
| + | |||
| + | Then reboot your router, waiting it finished rollback in minutes. | ||
| + | |||
| + | ==== OEM installation using the TFTP method ==== | ||
| + | |||
| + | -> [[docs: | ||
| + | |||
| + | === Specific values needed for tftp === | ||
| + | |||
| + | <WRAP BOX> | ||
| + | |||
| + | FIXME Enter values for " | ||
| + | |||
| + | ^ Bootloader tftp server IPv4 address | ||
| + | ^ Bootloader MAC address (special) | ||
| + | ^ Firmware tftp image | [[: | ||
| + | ^ TFTP transfer window | ||
| + | ^ TFTP window start | approximately FILL-IN seconds after power on | | ||
| + | ^ TFTP client required IP address | ||
| + | |||
| + | </ | ||
| + | |||
| + | ===== Upgrading OpenWrt ===== | ||
| + | -> [[docs: | ||
| + | |||
| + | |||
| + | ==== LuCI Web Upgrade Process ==== | ||
| + | |||
| + | * Browse to ''< | ||
| + | * Upload image file for sysupgrade to LuCI | ||
| + | * Wait for reboot | ||
| + | |||
| + | ==== Terminal Upgrade Process ==== | ||
| + | |||
| + | If you don't have a GUI (LuCI) available, you can alternatively upgrade via the command line. | ||
| + | There are two command line methods for upgrading: | ||
| + | |||
| + | * '' | ||
| + | * '' | ||
| + | |||
| + | Note: It is important that you put the firmware image into the ramdisk (/tmp) before you start flashing. | ||
| + | |||
| + | === sysupgrade === | ||
| + | |||
| + | * Login as root via SSH on 192.168.1.1, | ||
| + | |||
| + | < | ||
| + | cd /tmp | ||
| + | wget https:// | ||
| + | sysupgrade / | ||
| + | </ | ||
| + | |||
| + | === mtd === | ||
| + | |||
| + | If '' | ||
| + | |||
| + | * Login as root via SSH on 192.168.1.1, | ||
| + | |||
| + | < | ||
| + | cd /tmp | ||
| + | wget http:// | ||
| + | mtd write / | ||
| + | </ | ||
| + | |||
| + | ===== Downgrading stock firmware ===== | ||
| + | This section is kept only for historical reference, as it relates to the deprecated OpenWrt installation method that was applicable only to the RD03 (Chinese version) with stock firmware version 1.0.47. Please note that none of the current installation methods require a firmware downgrade to flash OpenWrt. | ||
| + | |||
| + | **To downgrade** a firmware version on your router, navigate to the upload firmware page and select the appropriate software version. It will complain about the downgrade. Edit the url and change the < | ||
| - | /*** if info available: uncomment and fill in | ||
| ===== Debricking ===== | ===== Debricking ===== | ||
| -> [[docs: | -> [[docs: | ||
| - | ***/ | ||
| + | Assume that you have installed OpenWrt with stock bootloader, with original u-boot: | ||
| + | |||
| + | * Connect to router via UART | ||
| + | * Select //Load Image// in the u-boot | ||
| + | * Set start address to 0x48000000, then set TFTP parameters to load the [[https:// | ||
| + | * Start the loaded kernel, then perform sysupgrade on OpenWrt. | ||
| + | |||
| + | If you have installed OpenWrt with u-boot mode layout, you can still use above UART recovery procedure, but u-boot will also look for a file called '' | ||
| + | |||
| + | If you provide that file in a tftp server, it'll be automatically loaded and run, so system can be recovered without using a UART connection. | ||
| + | |||
| + | |||
| + | |||
| + | ==== Recover bricked bootloader ==== | ||
| + | |||
| + | If your bootloader is bricked you can use the Mediateks ability to load a bootloader directly over UART with a tool called mtk_uartboot. | ||
| + | |||
| + | Details explained in [[https:// | ||
| + | |||
| + | ==== TFTP instructions for the stock bootloader ==== | ||
| + | AX3000T can be recovered from a soft-brick with TFTP. The flow is: | ||
| + | * The router boots and asks for an IP address on the LAN ports via DHCP | ||
| + | * The TFTP server assigns an IP address to the router | ||
| + | * The router then connects to the TFTP server (where your DHCP server listen, e.g.: 192.168.31.100) and tries to download a file named with the IP address given by the DHCP server converted to hexadecimal. | ||
| + | |||
| + | Because of this quirk we will have to configure the tftp server to assign only one IP and we will set the file name to the only IP address it can receive. | ||
| + | |||
| + | For Windows you can use [[https:// | ||
| + | These are the steps to do it for Linux (this can be adapted to the tftpd64' | ||
| + | |||
| + | * Create a folder somewhere to place your firmware for the tftp server and download the OEM firmware (the file name is a very important part; depending on the previously installed Xiaomi firmware version, you may need to adjust the name of the .img file to a different one. The router will be looking for a specific file name on the tftp server – if the requested file in the terminal does not match the one you have in the tmp folder, rename it accordingly and proceed again):< | ||
| + | wget https:// | ||
| + | * To ensure that the TFTP server has access to the firmware, set the privileges:< | ||
| + | sudo chown -R nobody: | ||
| - | /*** if info available: uncomment | + | * Obtain the name of the ethernet adapter (to be used in further steps):< |
| + | | ||
| + | link/ | ||
| + | 2: enp2s0: < | ||
| + | link/ether xx: | ||
| + | 3: wlp3s0: < | ||
| + | link/ether yy: | ||
| + | | ||
| + | sudo ip address add 192.168.31.100/ | ||
| + | | ||
| + | * Unplug the power, press and hold the reset button, plug the power back while still holding the button.< | ||
| + | * Hold the reset button until the router' | ||
| + | * then it goes solid orange again, release the button. | ||
| + | * If in the terminal, you see that the router requests a different firmware file (different name), rename the .img file in the tmp folder accordingly and repeat the procedures from the IP flush again. | ||
| + | </ | ||
| + | * When the device finished loading the firmware, the led starts flashing with orange (amber) light. Wait for until blue led to goes solid! <WRAP info> | ||
| + | * It might take some time for the led to go solid blue | ||
| + | * If the recovery doesn' | ||
| + | * If the led is blinking blue led it means the device was flashed successfully and can be restarted | ||
| + | </ | ||
| + | * Put your interface back to DHCP mode and start again with breaking your device | ||
| ===== Failsafe mode ===== | ===== Failsafe mode ===== | ||
| -> [[docs: | -> [[docs: | ||
| - | ***/ | ||
| - | |||
| - | /*** if info available: uncomment and fill in | ||
| ===== Basic configuration ===== | ===== Basic configuration ===== | ||
| - | After flashing, proceed with [[docs: | + | -> [[docs: |
| - | ***/ | + | Set up your Internet connection, configure wireless, configure USB port, etc. |
| + | * note: configuration reset issue after 6 reboots sometimes occurs on the AX3000T and is [[https:// | ||
| - | /*** if info available: uncomment and fill in | + | sed -i '/exit 0/i sleep 5\nfw_setenv flag_try_sys1_failed 0' / |
| - | ===== Specific configuration ===== | + | |
| - | <WRAP BOX 600px> | + | **Don' |
| - | FIXME Please fill in real values for this device, then remove the EXAMPLEs | + | |
| + | ===== Specific Configuration ===== | ||
| ==== Network interfaces ==== | ==== Network interfaces ==== | ||
| The default network configuration is: | The default network configuration is: | ||
| - | ^ Interface Name | + | ^ Interface Name ^ Description |
| - | | br-lan | + | | br-lan |
| - | | vlan0 (eth0.0) | + | | lanX (eth0) |
| - | | vlan1 (eth0.1) | + | | wan (eth0) |
| - | | wl0 | + | | phy0-ap0 |
| - | </ | + | | phy1-ap0 |
| - | ***/ | + | |
| + | ==== Switch Ports (for VLANs) ==== | ||
| + | |||
| + | Numbers 2-4 are Ports 1-3 as labeled on the unit, number 4 is the Internet (WAN) on the unit, 0 is the internal connection to the router itself. | ||
| + | ^ Port ^ Switch port ^ | ||
| + | | Internet (WAN) | 1 | | ||
| + | | LAN 2 | 2 | | ||
| + | | LAN 3 | 3 | | ||
| + | | LAN 4 | 4 | | ||
| - | /*** if info available: uncomment and fill in | ||
| ==== Buttons ==== | ==== Buttons ==== | ||
| -> [[docs: | -> [[docs: | ||
| Here, we merely name the buttons, so we can use them in the above Howto. | Here, we merely name the buttons, so we can use them in the above Howto. | ||
| - | |||
| - | <WRAP BOX 600px> | ||
| - | FIXME Please fill in real values for this device, then remove the EXAMPLEs and the WRAP that encloses this text. | ||
| The Xiaomi AX3000T has the following buttons: | The Xiaomi AX3000T has the following buttons: | ||
| - | ^ BUTTON | + | ^ BUTTON |
| - | | EXAMPLE | + | | Reset |
| - | | EXAMPLE Secure Easy Setup | + | | Mesh |
| - | | EXAMPLE No buttons at all. | + | |
| - | </ | + | |
| - | ***/ | + | |
| ===== Hardware ===== | ===== Hardware ===== | ||
| ==== Info ==== | ==== Info ==== | ||
| - | ^ Architecture | ||
| - | ^ Vendor | ||
| - | ^ Bootloader | ||
| - | ^ System-On-Chip | ||
| - | ^ CPU/ | ||
| - | ^ Flash-Chip | ||
| - | ^ Flash size | EXAMPLE 8 MiB | | ||
| - | ^ RAM | EXAMPLE 64 MiB | | ||
| - | ^ Wireless | ||
| - | ^ Ethernet | ||
| - | ^ Switch | ||
| - | ^ USB | EXAMPLE 1x 2.0 | | ||
| - | ^ Serial | ||
| - | ^ JTAG | EXAMPLE [[#JTAG|Not populated]] | ||
| - | /*** if info available: uncomment and fill in | + | <!-- ToH: { |
| - | ==== Flash Layout ==== | + | " |
| - | <WRAP BOX> | + | " |
| - | FIXME //[[:docs:techref:flash.layout# | + | " |
| - | + | " | |
| - | Please check out the article [[docs:techref:flash.layout|Flash layout]]. It contains examples and explanations that describe how to document the flash layout. | + | " |
| - | </WRAP> | + | " |
| - | ***/ | + | } --> |
| ==== Photos ==== | ==== Photos ==== | ||
| Line 143: | Line 420: | ||
| /* Thanks, your wiki administration - Oct. 2015 */ | /* Thanks, your wiki administration - Oct. 2015 */ | ||
| + | // | ||
| **Insert photo of front of the casing** | **Insert photo of front of the casing** | ||
| + | //Back://\\ | ||
| **Insert photo of back of the casing** | **Insert photo of back of the casing** | ||
| + | //Backside label://\\ | ||
| **Insert photo of backside label** | **Insert photo of backside label** | ||
| - | |||
| - | **Insert photo of PCB** | ||
| ==== Opening the case ==== | ==== Opening the case ==== | ||
| + | |||
| + | **Note:** This will void your warranty! | ||
| <WRAP BOX> | <WRAP BOX> | ||
| - | FIXME //Describe what needs to be done to open the device, e.g. remove | + | - Remove 4 rubber feet on the bottom of the device |
| + | - Use a Phillips screwdriver to remove | ||
| + | - A tiny flathead or plastic pry tool can be wedged in between the bottom case by the antennas. Gently push and slide it along the groove and it will pop open. | ||
| </ | </ | ||
| + | |||
| + | //Main PCB://\\ | ||
| + | **Insert photo of PCB** | ||
| ==== Serial ==== | ==== Serial ==== | ||
| Line 161: | Line 446: | ||
| How to connect to the Serial Port of this specific device:\\ | How to connect to the Serial Port of this specific device:\\ | ||
| - | **Insert photo of PCB with markings for serial port** | + | {{: |
| - | + | ^ Serial connection. parameters\\ for Xiaomi AX3000T | |
| - | <WRAP BOX> | + | |
| - | FIXME //Replace EXAMPLE by real values.// | + | |
| - | </ | + | |
| - | + | ||
| - | ^ Serial connection parameters\\ for Xiaomi AX3000T | + | |
| ==== JTAG ==== | ==== JTAG ==== | ||
| Line 174: | Line 454: | ||
| How to connect to the JTAG Port of this specific device:\\ | How to connect to the JTAG Port of this specific device:\\ | ||
| **Insert photo of PCB with markings for JTAG port** | **Insert photo of PCB with markings for JTAG port** | ||
| + | |||
| + | ===== Bootloader mods ===== | ||
| + | -> [[docs: | ||
| + | |||
| + | |||
| + | ===== Hardware mods ===== | ||
| + | |||
| ===== Bootlogs ===== | ===== Bootlogs ===== | ||
| - | ==== OEM bootlog ==== | ||
| - | <WRAP bootlog> | ||
| - | < | ||
| - | </ | ||
| - | ==== OpenWrt bootlog ==== | ||
| - | <WRAP bootlog> | ||
| - | < | ||
| - | </ | ||
| ===== Notes ===== | ===== Notes ===== | ||
| + | |||
| + | * DC power barrel plug dimensions 4.0mm x 1.7mm. | ||
| + | |||
| ===== Tags ===== | ===== Tags ===== | ||
| - | [[meta: | + | |
| - | {{tag>EXAMPLETAG unsupported}} | + | {{tag>mediatek MT7981 128NAND 256RAM 4Port GigabitEthernet 0usb 4core 4x4 hwVLAN 802.11ax wifi6 u-boot ARMv8 cortexa53 Filogic Serial 12v_powered}} |