TLDR:
My new AX3000T RD03 1.0.84 AN8855 is bricked.
UART at boot:
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
F5: 480A 0031
00: 1005 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
01: 102A 0001
02: 1005 0000
BP: 2000 00C0 [0001]
EC: 0000 0000 [1000]
T0: 0000 00ED [010F]
System halt!
I'm able to start UART debrick with this command line from my PC:
mtk_uartboot -s COM3 --payload bl2-mt7981-bga-ddr3-ram.bin --aarch64 --fip openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip && putty.exe -serial COM3 -sercfg 115200,8,n,1,N
(note it's also possible to load this image from UART, interesting but still no ethernet)
But I'm stuck at the TFTP step because I can't join the router by ethernet.
UART output during restore:
Volume fit not found!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; starting again
Wrong Image Type for bootm command
ERROR -91: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; starting again
Wrong Image Type for bootm command
ERROR -91: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; starting again
Some additional info get with command lines from the UART restore :
MT7981> bdinfo
boot_params = 0x0000000000000000
DRAM bank = 0x0000000000000000
-> start = 0x0000000040000000
-> size = 0x0000000010000000
flashstart = 0x0000000000000000
flashsize = 0x0000000000000000
flashoffset = 0x0000000000000000
baudrate = 115200 bps
relocaddr = 0x000000004ff30000
reloc off = 0x000000000e130000
Build = 64-bit
current eth = ethernet@15100000
ethaddr = 32:86:50:31:3c:83
IP addr = 192.168.1.1
fdt_blob = 0x0000000041e983e0
new_fdt = 0x0000000000000000
fdt_size = 0x0000000000000000
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
lmb_dump_all:
memory.cnt = 0x1 / max = 0x40
memory[0] [0x40000000-0x4fffffff], 0x10000000 bytes flags: 0
reserved.cnt = 0x3 / max = 0x40
reserved[0] [0x42ff0000-0x42ffffff], 0x00010000 bytes flags: 0
reserved[1] [0x43000000-0x4302ffff], 0x00030000 bytes flags: 4
reserved[2] [0x4f7faea0-0x4fffffff], 0x00805160 bytes flags: 0
devicetree = embed
arch_number = 0x0000000000000000
TLB addr = 0x000000004fff0000
irq_sp = 0x000000004f7ffd90
sp start = 0x000000004f7ffd90
Early malloc usage: a18 / 4000
MT7981> env print
boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
bootargs=console=ttyS0,115200n8 console_msg_format=syslog
bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
bootconf=config-1
bootdelay=3
bootfile=openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb
bootfile_bl2=openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-preloader.bin
bootfile_fip=openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip
bootfile_upg=openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb
bootled_pwr=yellow:status
bootled_rec=blue:status
bootmenu_0=Run default boot command.=run boot_default
bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
bootmenu_8=Reboot.=reset
bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
bootmenu_default=0
bootmenu_delay=3
bootmenu_title= ( ( ( OpenWrt ) ) ) U-Boot 2024.07-OpenWrt-r27433-7e1d092552 (Sep 16 2024 - 20:47:44 +0000)
console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
ethact=ethernet@15100000
ethaddr=32:86:50:31:3c:83
ipaddr=192.168.1.1
loadaddr=0x46000000
mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
replacevol=1
reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
serverip=192.168.1.254
ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
ver=U-Boot 2024.07-OpenWrt-r27433-7e1d092552 (Sep 16 2024 - 20:47:44 +0000)
mtd list
List of MTD devices:
* spi-nand0
- device: spi_nand@0
- parent: spi@1100a000
- driver: spi_nand
- path: /spi@1100a000/spi_nand@0
- type: NAND flash
- block size: 0x20000 bytes
- min I/O: 0x800 bytes
- OOB size: 64 bytes
- OOB available: 56 bytes
- 0x000000000000-0x000008000000 : "spi-nand0"
- 0x000000000000-0x000000100000 : "bl2"
- 0x000000100000-0x000000140000 : "Nvram"
- 0x000000140000-0x000000180000 : "Bdata"
- 0x000000180000-0x000000380000 : "factory"
- 0x000000380000-0x000000580000 : "fip"
- 0x000000580000-0x0000005c0000 : "crash"
- 0x0000005c0000-0x000000600000 : "crash_log"
- 0x000000600000-0x000007600000 : "ubi"
- 0x000007600000-0x000007640000 : "KF"
bootmenu
( ( ( OpenWrt ) ) ) U-Boot 2024.07-OpenWrt-r27433-7e1d092552 (Sep 16 2024 - 20:47:44 +0000)
1. Run default boot command.
2. Boot system via TFTP.
3. Boot production system from NAND.
4. Boot recovery system from NAND.
5. Load production system via TFTP then write to NAND.
6. Load recovery system via TFTP then write to NAND.
7. Load BL31+U-Boot FIP via TFTP then write to NAND.
8. Load BL2 preloader via TFTP then write to NAND.
9. Reboot.
a. Reset all settings to factory defaults.
0. Exit
I need help from experts to go back to a working state 
(I have a backup).
Let me know if you need more information to establish a diag.
I suppose I must restore FIT first ? But I'm not a router expert, how to transfert the required file without working ethernet ports (port is up but no data from the router itself) ?
Or I will need to recover my backup with SPI tools ? Is there a tutorial for that ? (I saw this post but @rasorocks didn't detailed which SPI programmer he used and how to plug it. I suppose that I will have to investigate on the 25N01KVZEIR and solder directly on it...
Thank you.