Bricked AX3000T, please about help

Installing and Using OpenWrt
1

Hello all,

I tried install open wrt in AX3000T (rd03, ESMT). Something went wrong and router not working. I opened case, add UART and I have something like that:

  *** U-Boot Boot Menu ***

     1. Startup system (Default)
     2. Startup firmware0
     3. Startup firmware1
     4. Upgrade firmware
     5. Upgrade ATF BL2
     6. Upgrade ATF FIP
     7. Upgrade single image
     8. Load image
     0. U-Boot console

  Hit any key to stop autoboot:  4
  Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit

When I select 1, I have:

 *** U-Boot Boot Menu ***

     1. Startup system (Default)
     2. Startup firmware0
     3. Startup firmware1
     4. Upgrade firmware
     5. Upgrade ATF BL2
     6. Upgrade ATF FIP
     7. Upgrade single image
     8. Load image
     0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit
detect button reset released!
Reading from 0x0 to 0x4f7fdd7c, size 0x4 ... OK
Boot failure detected on both systems
Reading from 0x0 to 0x4f7fdd7c, size 0x4 ... OK
Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK
Writing to MTD device 'nmbm0'... OK
OK
Booting System 1, sys1_failed = 8, sys2_failed = 204
ubi0: attaching mtd10
ubi0: scanning is finished
ubi0: attached mtd10 (name "ubi1", size 34 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 231, total reserved PEBs: 41, PEBs reserved for bad PEB handling: 19
Reading from volume 'kernel' to 0x46000000, size 0x0 ... *** Cannot find volume 'kernel' ***
resetting ...

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024F [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):e233a3d581-dirty
NOTICE:  BL2: Built : 06:23:27, Jul 30 2023
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a003f1 000000ff 00100000 00000000
1001d040 | 00027e71 000200a0 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0xc
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 576, worse bit 0, min window 72
Window Sum 556, worse bit 9, min window 68
Window Sum 396, worse bit 2, min window 48
Window Sum 314, worse bit 15, min window 36
Window Sum 402, worse bit 2, min window 48
Window Sum 318, worse bit 8, min window 38
Window Sum 406, worse bit 0, min window 50
Window Sum 320, worse bit 8, min window 38
Window Sum 328, worse bit 9, min window 38
Window Sum 334, worse bit 9, min window 40
Window Sum 340, worse bit 11, min window 40
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xc8
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):e233a3d581-dirty
NOTICE:  BL31: Built : 06:23:27, Jul 30 2023
NOTICE:  Hello BL31!!!
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000

  *** U-Boot Boot Menu ***

     1. Startup system (Default)
     2. Startup firmware0
     3. Startup firmware1
     4. Upgrade firmware
     5. Upgrade ATF BL2
     6. Upgrade ATF FIP
     7. Upgrade single image
     8. Load image
     0. U-Boot console

And this is loop.

What can I do new for this ? Is there any way ?

2

Did you follow https://openwrt.org/inbox/toh/xiaomi/ax3000t, and how far did you get ?

You can always use 0 then bootm to get to the initramfs part, but then you'll be skipping a lot of stuff that was supposed to be done earlier.

3

I did last step

sysupgrade -n /tmp/openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-squashfs-sysupgrade.bin

And I think, that I unpluged router from power too fast.

Next I tried with UART instruction,

And I stopped with point 7

4

Point 7 is pretty much what I described, on a high level, using serial.

You should carry on.

5

Ensure the firewall is disabled properly.
Also see last sentence in this post: OpenWrt support for Xiaomi AX3000T - #706 by woksio

6

Hi

Now I am in point 9 and after command ubidetach -p /dev/mtd8 I have:

ubidetach: error!: cannot detach "/dev/mtd8"
           error 16 (Resource busy)
7

Have you tried multiple times starting from scratch following all the steps, but still encounter the same issue with ubidetach: error!: cannot detach "/dev/mtd8" ?

Then it’s better firstly attempt restoring the default factory stock firmware by following the official instructions:

8

Something went wrong. When I tried restoring facotyr stock I saw error in putty, reset switch do nothing.


NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xc8
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):e233a3d581-dirty
NOTICE:  BL31: Built : 06:23:27, Jul 30 2023
NOTICE:  Hello BL31!!!
9

@certino, download official stock firmware for RD03, and try TFTP method via MIWIFIRepairTool

10

Nope. The same like above. Hello BL31!!

Working only Your instruction but in point 9, at the end after reboot I have Hello BL31!!

OK. I have progress. I dont know how but I saw

obraz_2024-09-09_211754847
obraz_2024-09-09_211754847856×292 8.7 KB

But I can't install LUCI - it's some problem with DNS

It's possible now back to factory and install openwrt once again ?? Holding reset still not work.

11

Based on the screenshot, you have an alternative bootloader installed (OpenWrt U-Boot)?

If yes, select option 6 and install the OpenWrt itb recovery firmware (the "ubootmod" version!! : openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb ):

If successful, proceed from guide's point 8.

Basically, if you have OpenWrt U-Boot installed, then you need to use firmware files for ubootmod instead of the files for the default bootloader during UART flashing.

1 Like
12

Thanks all for help. Router is alive :slight_smile:

13

If your problem is solved, would you please mark topic as [solved] and proper answer as solution?
See How to mark a topic as [Solved] for a short how-to.

14

Once again I used to instruction with ubootmod version and worked

15

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.