Help unbrick Xiaomi AX3000 router

After flashing wrong(?) firmware now I have UART access only. TFTP uploading okay but nothing happens :frowning: after reboot

In normal boot mode packets go from PC network card but received zero.

Is any method to restore this?

How to upload firmware via UART (serial) or where to find it when it uploaded via TFTP?
It shows me

BOOTP broadcast 3
BOOTP broadcast 4
BOOTP broadcast 5

and nothing happens (no reboot, no flashing, no command line)

tftp log

U-Boot 2016.01 (Nov 08 2021 - 13:00:55 +0000), Build: jenkins-common_router_openwrt_ota_publish-2158

DRAM: smem ram ptable found: ver: 1 len: 4
256 MiB
USB: Node Not found, skipping initiaโ–’*9โ–’ QPIC controller support serial NAND
ID = 7f7f11c8
Vendor = c8
Device = 11
Serial Nand Device Found With ID : 0xc8 0x11
Serial NAND device Manufacturer:F50D1G41LB(2M)
Device Size:128 MiB, Page size:2048, Spare Size:64, ECC:4-bit
ESMT F50D1G41LB(2M), disable serial training.
Error in serial training.
switch back to 50MHz with feed back clock bit enabled
SF: Unsupported flash IDs: manuf 00, jedec 0000, ext_jedec 0000
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
128 MiB
MMC: sdhci: Node Not found, skipping initialization

PCI0 is not defined in the device tree
PCI1 is not defined in the device tree
In: serial@78AF000
Out: serial@78AF000
Err: serial@78AF000
machid: 8040000
bootwait is on, bootdelay=3

main_loop: bootcmd="bootmiwifi"

Hit any key to stop autoboot: 0
miwifi: check crash in rmem !
detect button press, continue check 5 secs
detect button pressed 5 secs !
confirm to launch xq_upgrade !
cmd=dhcp

Net: cmbblk is stable 5
MAC0 addr:24:cf:24:77:9c:8e
PHY ID1: 0x4d
PHY ID2: 0xd0c0
MAC1 addr:c8:bf:4c:36:d5:ab
athrs17_reg_init: complete
athrs17_vlan_config ...done
S17c init done
eth0, eth1 [PRIME]
Trying to ping server.....
Port1 Down Speed :10M Half duplex
eth0 Down Speed :10 Half duplex
ping failed; host 192.168.31.100 is not alive
Port1 Down Speed :10M Half duplex
eth0 Down Speed :10 Half duplex
ping failed; host 192.168.31.100 is not alive
Port1 Down Speed :10M Half duplex
eth0 Down Speed :10 Half duplex
ping failed; host 192.168.31.100 is not alive
Port1 Down Speed :10M Half duplex
Port5 Down Speed :10M Half duplex
eth0 Down Speed :10 Half duplex
ping failed; host 192.168.31.100 is not alive
Ping test fail
Port1 Up Speed :1000M Full duplex
Port5 Up Speed :1000M Full duplex
BOOTP broadcast 1
BOOTP broadcast 2
BOOTP broadcast 3
...

dmesg

root@OpenWrt:/# dmesg
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 5.4.164 (runner@fv-az778-434) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 ci-20240727-173350-ab1f9ffa)) #0 SMP PREEMPT Mon Apr 17 13:15:36 2023
[ 0.000000] CPU: ARMv7 Processor [51af8014] revision 4 (ARMv7), cr=10c0383d
[ 0.000000] CPU: div instructions available: patching division code
[ 0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[ 0.000000] OF: fdt: Machine model: CMCC RAX3000Q
[ 0.000000] Memory policy: Data cache writealloc
[ 0.000000] On node 0 totalpages: 49152
[ 0.000000] Normal zone: 576 pages used for memmap
[ 0.000000] Normal zone: 0 pages reserved
[ 0.000000] Normal zone: 49152 pages, LIFO batch:15
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv1.0 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: MIGRATE_INFO_TYPE not supported.
[ 0.000000] psci: SMC Calling Convention v1.0
[ 0.000000] psci: OSI mode supported.
[ 0.000000] percpu: Embedded 15 pages/cpu s32204 r8192 d21044 u61440
[ 0.000000] pcpu-alloc: s32204 r8192 d21044 u61440 alloc=154096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 48576
[ 0.000000] Kernel command line: ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs cnss2.bdf_integrated=0x24 cnss2.bdf_pci0=0x60 cnss2.bdf_pci1=0x60 cnss2.skip_radt_en=1 root=/dev/ubiblock0_1 coherent_pool=2M
[ 0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[ 0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[ 0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.000000] Memory: 183392K/196608K available (6900K kernel code, 264K rwdata, 2092K rodata, 1024K init, 363K bss, 13216K reserved, 0K cma-reserved, 0K highmem)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] rcu: Preemptible hierarchical RCU implementation.
[ 0.000000] Tasks RCU enabled.
[ 0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[ 0.000000] NR_IRQS: 16, nr_irqs: 16, preallocated irqs: 16
[ 0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[ 0.000000] GICv2m: range[mem 0x0b00b000-0x0b00bffc], SPI[480:511]
[ 0.000000] random: get_random_bytes called from start_kernel+0x344/0x4f4 with crng_init=0
[ 0.000000] arch_timer: cp15 and mmio timer(s) running at 24.00MHz (virt/virt).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 440795202592 ns
[ 0.000006] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[ 0.000018] Switching to timer-based delay loop, resolution 41ns
[ 0.000414] Console: colour dummy device 80x30
[ 0.000910] printk: console [tty0] enabled
[ 0.000948] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
[ 0.000984] pid_max: default: 32768 minimum: 301
[ 0.001144] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.001181] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[ 0.002096] CPU: Testing write buffer coherency: ok
[ 0.002562] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
[ 0.003405] Setting up static identity map for 0x41300000 - 0x41300060
[ 0.003607] rcu: Hierarchical SRCU implementation.
[ 0.004123] smp: Bringing up secondary CPUs ...
[ 0.005159] CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
[ 0.005356] smp: Brought up 1 node, 2 CPUs
[ 0.005407] SMP: Total of 2 processors activated (96.00 BogoMIPS).
[ 0.005426] CPU: All CPU(s) started in SVC mode.
[ 0.013963] VFP support v0.3: implementor 51 architecture 3 part 40 variant 3 rev 4
[ 0.014407] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.014464] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[ 0.014641] pinctrl core: initialized pinctrl subsystem
[ 0.015813] NET: Registered protocol family 16
[ 0.017395] DMA: preallocated 2048 KiB pool for atomic coherent allocations
[ 0.018696] cpuidle: using governor ladder
[ 0.018777] cpuidle: using governor menu
[ 0.019028] NET: Registered protocol family 42
[ 0.019477] hw-breakpoint: found 5 (+1 reserved) breakpoint and 4 watchpoint registers.
[ 0.019515] hw-breakpoint: maximum watchpoint size is 8 bytes.
[ 0.064877] qcom,gcc-ipq5018 1800000.gcc: Registered ipq5018 GCC clocks provider
[ 0.079464] msm_sps_probe: sps:sps is ready
[ 0.108503] pps_core: LinuxPPS API ver. 1 registered
[ 0.108537] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti giometti@linux.it
[ 0.108581] PTP clock support registered
[ 0.109446] Advanced Linux Sound Architecture Driver Initialized.
[ 0.109581] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[ 0.111013] clocksource: Switched to clocksource arch_sys_counter
[ 0.115645] thermal_sys: Registered thermal governor 'step_wise'
[ 0.115651] thermal_sys: Registered thermal governor 'user_space'
[ 0.116708] NET: Registered protocol family 2
[ 0.116883] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.117756] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[ 0.117833] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[ 0.117890] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.117948] TCP: Hash tables configured (established 2048 bind 2048)
[ 0.118080] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.118128] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[ 0.118408] NET: Registered protocol family 1
[ 0.118467] PCI: CLS 0 bytes, default 64
[ 0.120044] workingset: timestamp_bits=14 max_order=16 bucket_order=2
[ 0.125951] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.125985] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.165047] Key type asymmetric registered
[ 0.165092] Asymmetric key parser 'x509' registered
[ 0.165174] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 246)
[ 0.167382] bam-dma-engine 704000.dma: num-channels unspecified in dt
[ 0.167425] bam-dma-engine 704000.dma: num-ees unspecified in dt
[ 0.168225] bam-dma-engine 7884000.dma: qcom,controlled-remotely unspecified
[ 0.169234] bam-dma-engine 7984000.dma: qcom,controlled-remotely unspecified
[ 0.171250] CPU: IPQ5000, SoC Version: 1.1
[ 0.172004] TZ Log : Will warn on Access Violation, as paniconaccessviolation is not set
[ 0.173235] msm_serial 78af000.serial: msm_serial: detected port #0
[ 0.173305] msm_serial 78af000.serial: uartclk = 1843199
[ 0.173388] 78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 29, base_baud = 115199) is a MSM
[ 0.173441] msm_serial: console setup on port #0
[ 0.775410] printk: console [ttyMSM0] enabled
[ 0.780406] msm_serial: driver initialized
[ 0.784958] random: fast init done
[ 0.788439] random: crng init done
[ 0.795937] brd: module loaded
[ 0.800659] loop: module loaded
[ 0.802927] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0x11
[ 0.802976] nand: ESMT F50D1G41LB(2M) SPI NAND 1G 1.8V
[ 0.809206] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[ 0.814260] qcom-nandc 79b0000.qpic-nand: cfg0 9a3c08d0 cfg1 8287440 ecc_buf_cfg 203 ecc_bch cfg 42040700 cw_size 528 cw_data 516 strength 4 parity_bytes 12 steps 4
[ 0.821944] qcom-nandc 79b0000.qpic-nand: Serial training partition not found
[ 0.836624] qcom-nandc 79b0000.qpic-nand: failed to enable serial training
[ 0.843730] 22 fixed-partitions partitions found on MTD device qcom_nand.0
[ 0.850356] Creating 22 MTD partitions on "qcom_nand.0":
[ 0.857245] 0x000000000000-0x000000080000 : "0:SBL1"
[ 0.864128] 0x000000080000-0x000000100000 : "0:MIBIB"
[ 0.869017] 0x000000100000-0x000000140000 : "0:BOOTCONFIG"
[ 0.873769] 0x000000140000-0x000000180000 : "0:BOOTCONFIG1"
[ 0.879092] 0x000000180000-0x000000280000 : "0:QSEE"
[ 0.885424] 0x000000280000-0x000000380000 : "0:QSEE_1"
[ 0.890550] 0x000000380000-0x0000003c0000 : "0:DEVCFG"
[ 0.894878] 0x0000003c0000-0x000000400000 : "0:DEVCFG_1"
[ 0.899846] 0x000000400000-0x000000440000 : "0:CDT"
[ 0.905394] 0x000000440000-0x000000480000 : "0:CDT_1"
[ 0.909907] 0x000000480000-0x000000500000 : "0:APPSBLENV"
[ 0.915451] 0x000000500000-0x000000640000 : "0:APPSBL"
[ 0.921636] 0x000000640000-0x000000780000 : "0:APPSBL_1"
[ 0.926526] 0x000000780000-0x000000880000 : "0:ART"
[ 0.931843] 0x000000880000-0x000000900000 : "0:TRAINING"
[ 0.935851] 0x000000900000-0x000000980000 : "bdata"
[ 0.941564] 0x000000980000-0x000000a00000 : "crash"
[ 0.946051] 0x000000a00000-0x000000a80000 : "crash_syslog"
[ 0.950886] 0x000000a80000-0x000002e80000 : "rootfs"
[ 0.990027] mtd: device 18 (rootfs) set to be root filesystem
[ 0.990355] mtdsplit: no squashfs found in "rootfs"
[ 0.994858] 0x000002e80000-0x000005280000 : "rootfs_1"
[ 1.034516] 0x000005280000-0x000007180000 : "overlay"
[ 1.065129] 0x000007180000-0x000007200000 : "rsvd0"
[ 1.067847] libphy: Fixed MDIO Bus: probed
[ 1.289073] qca-mdio 88000.mdio: Could not find phy-reset-gpio
[ 1.289317] libphy: qca_mdio: probed
[ 1.294591] qca-mdio 88000.mdio: qca-mdio driver was registered
[ 1.517913] qca-mdio 90000.mdio: Could not find phy-reset-gpio
[ 1.518181] libphy: qca_mdio: probed
[ 1.525376] qca-mdio 90000.mdio: qca-mdio driver was registered
[ 1.636716] i2c /dev entries driver
[ 1.637600] qcom-tsens 4a9000.thermal-sensor: tsens device is not enabled
[ 1.640811] cpufreq: cpufreq_online: CPU0: Running at unlisted freq: 799999 KHz
[ 1.646153] cpufreq: cpufreq_online: CPU0: Unlisted initial frequency changed to: 800000 KHz
[ 1.654672] sdhci: Secure Digital Host Controller Interface driver
[ 1.661835] sdhci: Copyright(c) Pierre Ossman
[ 1.667744] sdhci-pltfm: SDHCI platform and OF driver helper
[ 1.672677]
[ 1.672677] Version Rollback Feature Disabled
[ 1.680151] remoteproc remoteproc0: cd00000.remoteproc is available
[ 1.684646] remoteproc remoteproc1: 4ab000.remoteproc_pd1 is available
[ 1.690616] remoteproc remoteproc2: cd00000.remoteproc:remoteproc_pd2 is available
[ 1.696881] coresight-tmc 6048000.tmc: No Q6 ETR memory region specified
[ 1.704063] coresight-tmc 6047000.tmc: failed to get flush cti, defer probe
[ 1.710905] coresight-dynamic-funnel 6041000.funnel: Uses obsolete Coresight DT bindings
[ 1.719977] coresight coresight-etm0: CPU0: ETM v4.0 initialized
[ 1.725812] coresight-etm4x 619c000.etm: CPU0: (null) initialized
[ 1.732255] coresight coresight-etm1: CPU1: ETM v4.0 initialized
[ 1.737722] coresight-etm4x 619d000.etm: CPU1: (null) initialized
[ 1.744112] coresight-stm 6002000.stm: coresight-stm : stm_register_device failed, probing deferred
[ 1.749972] OF: graph: no port node found in /soc/cti@6010000
[ 1.758974] OF: graph: no port node found in /soc/cti@6011000
[ 1.764908] OF: graph: no port node found in /soc/cti@6012000
[ 1.770535] OF: graph: no port node found in /soc/cti@6013000
[ 1.776307] OF: graph: no port node found in /soc/cti@6014000
[ 1.782053] OF: graph: no port node found in /soc/cti@6015000
[ 1.787699] OF: graph: no port node found in /soc/cti@6016000
[ 1.793525] OF: graph: no port node found in /soc/cti@6017000
[ 1.799178] OF: graph: no port node found in /soc/cti@6018000
[ 1.804952] OF: graph: no port node found in /soc/cti@6019000
[ 1.810632] OF: graph: no port node found in /soc/cti@601a000
[ 1.816424] OF: graph: no port node found in /soc/cti@601b000
[ 1.822152] OF: graph: no port node found in /soc/cti@601c000
[ 1.827821] OF: graph: no port node found in /soc/cti@601d000
[ 1.833618] OF: graph: no port node found in /soc/cti@601e000
[ 1.839285] OF: graph: no port node found in /soc/cti@601f000
[ 1.845092] OF: graph: no port node found in /soc/cti@6198000
[ 1.850758] OF: graph: no port node found in /soc/cti@6199000
[ 1.856549] OF: graph: no port node found in /soc/cti@610c000
[ 1.863329] OF: graph: no port node found in /soc/hwevent@6101000
[ 1.867676] coresight-hwevent 6101000.hwevent: No csr data
[ 1.874150] OF: graph: no port node found in /soc/csr@6001000
[ 1.879245] coresight-csr 6001000.csr: CSR initialized: coresight-csr
[ 1.887079] NET: Registered protocol family 10
[ 1.892564] Segment Routing with IPv6
[ 1.895777] NET: Registered protocol family 17
[ 1.899513] Bridge firewalling registered
[ 1.903856] 8021q: 802.1Q VLAN Support v1.8
[ 1.908104] Registering SWP/SWPB emulation handler
[ 1.925392] coresight-tmc 6048000.tmc: No Q6 ETR memory region specified
[ 1.925573] sps_register_bam_device: sps:BAM 0x06064000 is registered
[ 1.932493] coresight coresight-stm: STM32 initialized
[ 1.937881] ubi0: attaching mtd19
[ 2.090228] ubi0: scanning is finished
[ 2.096132] ubi0: attached mtd19 (name "rootfs_1", size 36 MiB)
[ 2.096176] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[ 2.100862] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[ 2.107868] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[ 2.114692] ubi0: good PEBs: 288, bad PEBs: 0, corrupted PEBs: 0
[ 2.121460] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[ 2.127687] ubi0: max/mean erase counter: 3/1, WL threshold: 4096, image sequence number: 111446760
[ 2.134738] ubi0: available PEBs: 0, total reserved PEBs: 288, PEBs reserved for bad PEB handling: 20
[ 2.143739] ubi0: background thread "ubi_bgt0d" started, PID 84
[ 2.153863] block ubiblock0_1: created from ubi0:1(rootfs)
[ 2.158771] hctosys: unable to open rtc device (rtc0)
[ 2.164959] ALSA device list:
[ 2.169431] No soundcards found.
[ 2.176095] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[ 2.177321] Freeing unused kernel memory: 1024K
[ 2.211286] Run /sbin/init as init process
[ 2.435493] init: Console is alive
[ 2.435780] init: - watchdog -
[ 3.049635] kmodloader: loading kernel modules from /etc/modules-boot.d/

[ 3.104285] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 3.105257] init: - preinit -
[ 6.830126] UBIFS (ubi0:2): Mounting in unauthenticated mode
[ 6.830426] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 163
[ 6.858159] UBIFS (ubi0:2): recovery needed
[ 6.936660] UBIFS (ubi0:2): recovery completed
[ 6.936878] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[ 6.940147] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[ 6.948036] UBIFS (ubi0:2): FS size: 20951040 bytes (19 MiB, 165 LEBs), journal size 1015809 bytes (0 MiB, 8 LEBs)
[ 6.957843] UBIFS (ubi0:2): reserved for root: 989569 bytes (966 KiB)
[ 6.968060] UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID C1192ADA-CF73-496C-9D8F-C7D6A2ADB687, small LPT model
[ 6.977126] mount_root: switching to ubifs overlay
[ 6.993296] urandom-seed: Seeding with /etc/urandom.seed
[ 7.045322] procd: - early -
[ 7.045461] procd: - watchdog -
[ 7.638223] procd: - watchdog -
[ 7.677470] procd: - ubus -
[ 7.732256] procd: - init -
[ 8.085398] urngd: v1.0.2 started.
[ 8.132319] kmodloader: loading kernel modules from /etc/modules.d/*
[ 8.146038] ssdk_switch_device_num_init[1210]:INFO:ess-switch dts node number: 2
[ 8.146114] ssdk_dt_get_switch_node[1015]:INFO:ess-switch DT exist!
[ 8.152915] ssdk_dt_parse_access_mode[901]:INFO:switch_access_mode: local bus
[ 8.158505] ssdk_dt_parse_access_mode[914]:INFO:switchreg_base_addr: 0x39c00000
[ 8.165828] ssdk_dt_parse_access_mode[915]:INFO:switchreg_size: 0x200000
[ 8.172935] ssdk_dt_parse_mac_mode[304]:INFO:mac mode = 0xf
[ 8.179844] ssdk_dt_parse_mac_mode[310]:INFO:mac mode1 doesn't exit!
[ 8.185161] ssdk_dt_parse_mac_mode[319]:INFO:mac mode2 doesn't exit!
[ 8.191799] ssdk_dt_parse_port_bmp[802]:INFO:port_bmp doesn't exist!
[ 8.198105] ssdk_dt_parse_uniphy[341]:INFO:ess-uniphy DT exist!
[ 8.204445] ssdk_dt_parse_led[988]:INFO:current dts led_source_num is 0
[ 8.210069] ssdk_plat_init start
[ 10.781033] ssdk_mp_reset_init[812]:INFO:MP reset successfully!
[ 10.781108] ssdk_gcc_clock_init[1206]:INFO:SSDK gcc clock init successfully!
[ 10.787033] mpge_phy_api_ops_init[1089]:INFO:qca probe mpge phy driver succeeded!
[ 10.793523] mpge_phy_dac_set[917]:INFO:phy mdac is set as 0x10
[ 10.800478] mpge_phy_dac_set[929]:INFO:phy edac is set as 0x10
[ 10.806232] regi_init[3788]:INFO:Initializing SCOMPHY!
[ 11.975060] _adpt_mp_uniphy_clk_output_ctrl_set[236]:INFO:uniphy will output clock as 25000000Hz
[ 11.975200] ssdk_switch_register[1862]:INFO:Chip version 0xee
[ 11.982985] qca_link_polling_select[1370]:INFO:link-polling-required node does not exist
[ 11.988563] ssdk_switch_register[1896]:INFO:polling is selected
[ 11.996896] regi_init[3798]:INFO:Initializing SCOMPHY Done!!
[ 12.002492] ssdk_dt_get_switch_node[1015]:INFO:ess-switch DT exist!
[ 12.008268] ssdk_dt_parse_access_mode[901]:INFO:switch_access_mode: mdio
[ 12.014282] ssdk_dt_parse_mac_mode[301]:INFO:mac mode doesn't exit!
[ 12.021214] ssdk_dt_parse_mac_mode[310]:INFO:mac mode1 doesn't exit!
[ 12.027182] ssdk_dt_parse_mac_mode[319]:INFO:mac mode2 doesn't exit!
[ 12.033834] ssdk_dt_parse[1112]:INFO:switch node is qca83xx!
[ 12.040114] ssdk_plat_init start
[ 12.110722] f1_phy_api_ops_init[1603]:INFO:qca probe f1 phy driver succeeded!
[ 12.110760] regi_init[3737]:INFO:Initializing ISISC!!
[ 12.116880] OF: /soc/ess-instance/ess-switch1@1: could not get #gpio-cells for /soc/phy@86000
[ 12.121964] qca_ar8327_gpio_reset[3663]:ERROR:gpio26 request failed, ret:-517
[ 12.130535] ssdk_switch_register[1870]:INFO:Chip version 0x1302
[ 12.137564] qca_link_polling_select[1370]:INFO:link-polling-required node does not exist
[ 12.143258] ssdk_switch_register[1896]:INFO:polling is selected
[ 13.871027] regi_init[3742]:INFO:Initializing ISISC Done!!
[ 13.871145] regi_init[3824]:INFO:qca-ssdk module init succeeded!
[ 13.879786] (unnamed net_device) (uninitialized): nss_dp_gmac: Registering netdev eth%d(qcom-id:1) with GMAC, mac_base: 0x90be0000
[ 13.885497] (unnamed net_device) (uninitialized): nss_dp_gmac: Registering netdev eth%d(qcom-id:2) with GMAC, mac_base: 0x90f20000
[ 13.895736] **********************************************************
[ 13.904922] * NSS Data Plane driver
[ 13.913951] **********************************************************
[ 14.111998] nss_driver - fw of size 781856 bytes copied to load addr: 40000000, nss_id : 0
[ 14.113504] Supported Frequencies -
[ 14.113509] 850 MHz
[ 14.119156] 1 GHz
[ 14.123014]
[ 14.127049] 7f0e5e40: set sdma 8e951600
[ 14.128947] node size 2 # items 4
[ 14.132224] memory: 40000000 268435456 (avl 198553600) items 4 active_cores 1
[ 14.135659] addr/size storage words 2 2 # words 4 in DTS, ddr size 800000
[ 14.142811] 7f0e5e40: NSS core 0 DDR from 40000000 to 40800000
[ 14.149640] 7f0e5e40: meminfo init succeed
[ 14.157672] gre: GRE over IPv4 demultiplexor driver
[ 14.160916] ip_gre: GRE over IPv4 tunneling driver
[ 14.173726] Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[ 14.185922] node size 2 # items 4
[ 14.186001] memory: 40000000 268435456 (avl 198553600) items 4 active_cores 1
[ 14.188238] addr/size storage words 2 2 # words 4 in DTS, ddr size 800000
[ 14.195462] 7f0e5e40: nss core 0 booted successfully
[ 14.222747] PPP generic driver version 2.4.2
[ 14.224155] NET: Registered protocol family 24
[ 14.235906] nss_wifi_meshmgr_init_module[1997]:Module Build Id: 07/27/24, 18:42:50 loaded
[ 14.239711] Loading modules backported from Linux version ab1f9ff
[ 14.243359] Backport generated by backports.git ab1f9ff
[ 14.264085] PPTP driver version 0.8.5
[ 14.283447] xt_time: kernel timezone is -0000
[ 14.503571] ath11k c000000.wifi: ipq5018 hw1.0
[ 14.504172] remoteproc remoteproc1: powering up 4ab000.remoteproc_pd1
[ 14.540083] remoteproc remoteproc1: Booting fw image IPQ5018/q6_fw.mdt, size 1820
[ 14.540238] remoteproc remoteproc0: powering up cd00000.remoteproc
[ 14.546793] remoteproc remoteproc0: Booting fw image IPQ5018/q6_fw.mdt, size 1820
[ 16.183189] Subsystem error monitoring/handling services are up
[ 16.301070] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[ 16.311207] Subsystem error monitoring/handling services are up
[ 16.426940] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0x24 soc_id 0xffffffff
[ 16.427001] ath11k c000000.wifi: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id QC_IMAGE_VERSION_STRING=WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
[ 16.434867] remoteproc remoteproc1: remote processor 4ab000.remoteproc_pd1 is now up
[ 16.468964] ath11k c000000.wifi: qmi caldata downloaded: type: 2
[ 16.494240] ath11k c000000.wifi: No qcom,pta_num entry in dev-tree.
[ 16.494289] ath11k c000000.wifi: No qcom,coex_mode entry in dev-tree.
[ 16.499320] ath11k c000000.wifi: No qcom,bt-active-time entry in dev-tree.
[ 16.506047] ath11k soc:wifi1@c000000: qcn6122
[ 16.513305] remoteproc remoteproc2: powering up cd00000.remoteproc:remoteproc_pd2
[ 16.517316] remoteproc remoteproc2: Booting fw image IPQ5018/q6_fw.mdt, size 1820
[ 16.521276] ath11k c000000.wifi: No qcom,bt-priority-time entry in dev-tree.
[ 16.532188] Subsystem error monitoring/handling services are up
[ 16.539335] ath11k c000000.wifi: No qcom,coex-algo entry in dev-tree.
[ 16.545092] ath11k c000000.wifi: No qcom,pta-priority entry in dev-tree.
[ 16.611239] ath11k soc:wifi1@c000000: qmi ignore invalid mem req type 10
[ 16.651171] remoteproc remoteproc2: remote processor cd00000.remoteproc:remoteproc_pd2 is now up
[ 16.653566] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 16.686245] ath11k soc:wifi1@c000000: chip_id 0x0 chip_family 0x4 board_id 0x60 soc_id 0xffffffff
[ 16.686351] ath11k soc:wifi1@c000000: fw_version 0x270206d0 fw_build_timestamp 2022-08-04 13:28 fw_build_id QC_IMAGE_VERSION_STRING=WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICO
[ 16.716074] ath11k soc:wifi1@c000000: qmi caldata downloaded: type: 2
[ 16.799647] ath11k c000000.wifi: Direct firmware load for ath11k/IPQ5018/hw1.0/qdss_trace_config.bin failed with error -2
[ 16.799728] ath11k c000000.wifi: Falling back to sysfs fallback for: ath11k/IPQ5018/hw1.0/qdss_trace_config.bin
[ 16.927770] ieee80211 phy1: copying sband (band 1) due to VHT EXT NSS BW flag
[ 16.932919] ath11k soc:wifi1@c000000: Direct firmware load for ath11k/qcn6122/hw1.0/qdss_trace_config.bin failed with error -2
[ 16.933043] ath11k soc:wifi1@c000000: Falling back to sysfs fallback for: ath11k/qcn6122/hw1.0/qdss_trace_config.bin
[ 17.287826] ath11k c000000.wifi: Direct firmware load for qdss_trace_config.bin failed with error -2
[ 17.287902] ath11k c000000.wifi: Falling back to sysfs fallback for: qdss_trace_config.bin
[ 17.997635] ath11k c000000.wifi: qmi failed to load QDSS config: qdss_trace_config.bin
[ 17.997807] ath11k c000000.wifi: Failed to download QDSS config to FW: -12
[ 19.145144] ECM init
[ 19.145286] ECM database jhash random seed: 0x65d2e6d1
[ 19.149952] ECM init complete
[ 21.392514] br-lan: port 1(eth1) entered blocking state
[ 21.392568] br-lan: port 1(eth1) entered disabled state
[ 21.397380] device eth1 entered promiscuous mode
[ 21.410758] br-lan: port 1(eth1) entered blocking state
[ 21.410825] br-lan: port 1(eth1) entered forwarding state
[ 21.441542] nss-dp 39c00000.dp1 eth0: PHY Link up speed: 1000
[ 22.391846] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[ 22.567157] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready

ifconfig

root@OpenWrt:/# ifconfig
br-lan Link encap:Ethernet HWaddr C8:BF:4C:36:D5:AB
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fd46:ff88:1a4d:1::1/64 Scope:Global
inet6 addr: fe80::cabf:4cff:fe36:d5ab/64 Scope:Link
inet6 addr: fd46:ff88:1a4d:5::1/64 Scope:Global
inet6 addr: fd46:ff88:1a4d:2::1/63 Scope:Global
inet6 addr: fd46:ff88:1a4d:6::1/63 Scope:Global
inet6 addr: fd46:ff88:1a4d:3::1/64 Scope:Global
inet6 addr: fd46:ff88:1a4d:7::1/64 Scope:Global
inet6 addr: fd46:ff88:1a4d::1/60 Scope:Global
inet6 addr: fd46:ff88:1a4d:4::1/62 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:65 errors:0 dropped:0 overruns:0 frame:0
TX packets:83 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:10514 (10.2 KiB) TX bytes:15552 (15.1 KiB)

eth0 Link encap:Ethernet HWaddr 24:CF:24:77:9C:8E
inet addr:192.168.1.190 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::26cf:24ff:fe77:9c8e/64 Scope:Link
inet6 addr: fd46:ff88:1a4d:1:26cf:24ff:fe77:9c8e/64 Scope:Global
inet6 addr: fd46:ff88:1a4d:1::a19/128 Scope:Global
inet6 addr: fd46:ff88:1a4d:5:26cf:24ff:fe77:9c8e/64 Scope:Global
inet6 addr: fd46:ff88:1a4d:2:26cf:24ff:fe77:9c8e/64 Scope:Global
inet6 addr: fd46:ff88:1a4d:6:26cf:24ff:fe77:9c8e/64 Scope:Global
inet6 addr: fd46:ff88:1a4d:3:26cf:24ff:fe77:9c8e/64 Scope:Global
inet6 addr: fd46:ff88:1a4d:7:26cf:24ff:fe77:9c8e/64 Scope:Global
inet6 addr: fd46:ff88:1a4d::a19/128 Scope:Global
inet6 addr: fd46:ff88:1a4d:4:26cf:24ff:fe77:9c8e/64 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:80 errors:0 dropped:0 overruns:0 frame:0
TX packets:66 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:15664 (15.2 KiB) TX bytes:12030 (11.7 KiB)
Interrupt:97

eth1 Link encap:Ethernet HWaddr C8:BF:4C:36:D5:AB
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:120 errors:0 dropped:0 overruns:0 frame:0
TX packets:83 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:16900 (16.5 KiB) TX bytes:16046 (15.6 KiB)
Interrupt:98

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:452 errors:0 dropped:0 overruns:0 frame:0
TX packets:452 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:35356 (34.5 KiB) TX bytes:35356 (34.5 KiB)

I don't have one of these units, but i am working on support for the glinet-b3000, I am basing my port off of @hyzitc repo. There may be some helpful info there --> openwrt-redmi-ax3000

Download openwrt-ipq50xx-arm-redmi_ax3000-squashfs-nand-factory.ubi and put it into TFTP root.

Then run the following command inside U-boot:

# This router ip
setenv ipaddr 192.168.1.2
# TFTP server ip
setenv serverip 192.168.1.1

# Download the firmware to the RAM
tftpboot openwrt-ipq50xx-arm-redmi_ax3000-squashfs-nand-factory.ubi

# Flash it as system 2
flash rootfs_1
setenv flag_try_sys2_failed 0
setenv flag_boot_rootfs 1
setenv flag_last_success 1
saveenv

# Flash it as system 1
# flash rootfs
# setenv flag_try_sys1_failed 0
# setenv flag_boot_rootfs 0
# setenv flag_last_success 0
# saveenv

# Reboot
reset

b. Use miwifi (the vendor firmware) to flash

cd /tmp
wget https://github.com/hzyitc/openwrt-redmi-ax3000/releases/latest/download/openwrt-ipq50xx-arm-redmi_ax3000-squashfs-nand-factory.ubi

# Check your partition table
# cat /proc/mtd
[[ "$(grep '"rootfs"' /proc/mtd | cut -d':' -f1)" == "mtd18" ]] || exit
[[ "$(grep '"rootfs_1"' /proc/mtd | cut -d':' -f1)" == "mtd19" ]] || exit

# Detect the current system slot and flash into the other one
# cat /proc/cmdline
mtd="$(grep -oE 'ubi.mtd=[a-zA-Z0-9\-\_]*' /proc/cmdline | cut -d'=' -f2)"
if [[ "$mtd" == "rootfs" ]]; then
	# Flash it as system 2
	ubiformat /dev/mtd19 -f openwrt-ipq50xx-arm-redmi_ax3000-squashfs-nand-factory.ubi
	nvram set flag_try_sys2_failed=0
	nvram set flag_boot_rootfs=1
	nvram set flag_last_success=1
	nvram commit
elif [[ "$mtd" == "rootfs_1" ]]; then
	# Flash it as system 1
	ubiformat /dev/mtd18 -f openwrt-ipq50xx-arm-redmi_ax3000-squashfs-nand-factory.ubi
	nvram set flag_try_sys1_failed=0
	nvram set flag_boot_rootfs=0
	nvram set flag_last_success=0
	nvram commit
fi

# Reboot
reboot

perhaps you are using the wrong partion, the script seems to check for this

if [[ "$mtd" == "rootfs" ]]; then
	# Flash it as system 2 ...
elif [[ "$mtd" == "rootfs_1" ]]; then
	# Flash it as system 1 ...