No, if it works - I would suggest don't touch
1 Like
Thanks. Should i go from step 1 to the end as i do fresh installation?
yes, starting from step 1
Those can be restored with
insmod /lib/modules/$(uname -r)/mtd-rw.ko i_want_a_brick=1
mtd write Factory.bin Factory
You need the kmod-mtd-rw before that.
FIP is the bootloader, Factory contains MAC addresses, etc.
Running remittor's latest firmware, I noticed this error popping up in system log fairly frequently,
Sun Sep 22 09:38:48 2024 daemon.err nlbwmon[6293]: Netlink receive failure: Out of memory
Sun Sep 22 09:38:48 2024 daemon.err nlbwmon[6293]: Unable to dump conntrack: No buffer space available
any idea why this is happening? Thanks.
Error message is self explanatory, youâre running out of memory.
Run htop and track what is using ram.
Likely culprits are large Adblock lists, device only has 256mb ram.
tnx. Everything work!
1 Like
Hi,
Here's my story of a failed flash ! 
I've buyed a first AX3000T RD03, received with firmware 1.0.47, good !
Enabled SSH with curl commands, make my backups then flashed with the official procedure. No problem, I realised that Luci was not implemented in official openwrt image so I've tested X-WRT and then go back to ImmortalWRT for a more classical interface.
Then I've decided to buy a second AX3000T RD03 and this time it arrived with firmware 1.0.84 
I know that there are some differences so first I check the flash chip: Winbond 25N01KVZEIR in both cases (on the old and on the new router).
So I take the same procedure as before, just used a new SSH enabler method and made my backup.
But this time things aren't going so well: my router seems to reboot correctly but no ethernet connection available: the port is up but I don't receive any packet from the router.
So I've tried to flash it again with .ubi remittor image with "ubiformat /dev/mtd9 ..." command line.
I finally understand (by reading some posts on this topic) that if I don't have any ethernet port available it's probably because my router has AN8855 ethernet chip.
So I tried to flash again with an image from this post which contains AN8855 driver (thanks mrrdmr).
But strangely it was not better: same result no ethernet communication (I don't receive any packet from the ethernet port), no DHCP, no ping possible.
I tried a lot of different .ubi images with ubiformat command line with similar results: never have ethernet ports working. So I have soldered UART, and I saw that openwrt was displaying all the time "syntax error: unexpectecting ")" or didn't found some files.
By rebooting multiple times with reset button pushed and then mesh button pushed it has finally boot to stock firmware again. Great, I had ethernet available again with 192.168.31.xx address.
So I was on stock but I still saw some files not found on UART (rooâ -ash: rooâWrt:~#: notâ -ash:: not found) so I decide to restore my backup... But the lack of information about how to restore did help and from my previous softbrick I finally did a hard brick
("System halt!", I probably broke /dev/mtd1, /dev/mtd2, /dev/mtd3 and /dev/mtd8 by successive bad command lines).
Fortunately there is the UART method to repair a brick !
Great! so I achieved to run the restore procedure I realize that forcing the UART adapter to 3.3v is absolutely necessary to make it work. But once again: no ethernet port :: !
So the putty session is displaying "TFTP from server 192.168.1.254; our IP address is 192.168.1.1" but impossible to ping 192.168.1.1 from my computer so the TFTP server step is not working (one more time I don't receive any packet from the ethernet port)...
So finally my questions :
- During the UART procedure, I've used the default files (bl2-mt7981-bga-ddr3-ram.bin and openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip) should I use other ones to have my ethernet ports working during UART restoration ? The one from my backup ?
- What is the way to restore backuped files (BL2.bin, Nvram.bin, FIP.bin ...) ?
- Once fixed, which image should I use with my AN8855 chip switch ?
Thank you for your help!
hey thanks for getting back to me. i've run htop and nothing looks out of the ordinary. in fact, none of those additional services have been enabled, ie, blocklists, ddns, nextdns etc
Then youâll need to track mem usage until the error message occurs and look for a spike
TLDR:
My new AX3000T RD03 1.0.84 AN8855 is bricked.
UART at boot:
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
F5: 480A 0031
00: 1005 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
01: 102A 0001
02: 1005 0000
BP: 2000 00C0 [0001]
EC: 0000 0000 [1000]
T0: 0000 00ED [010F]
System halt!
I'm able to start UART debrick with this command line from my PC:
mtk_uartboot -s COM3 --payload bl2-mt7981-bga-ddr3-ram.bin --aarch64 --fip openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip && putty.exe -serial COM3 -sercfg 115200,8,n,1,N
(note it's also possible to load this image from UART, interesting but still no ethernet)
But I'm stuck at the TFTP step because I can't join the router by ethernet.
UART output during restore:
Volume fit not found!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; starting again
Wrong Image Type for bootm command
ERROR -91: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; starting again
Wrong Image Type for bootm command
ERROR -91: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb'.
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
Load address: 0x46000000
Loading: *
ARP Retry count exceeded; starting again
Some additional info get with command lines from the UART restore :
MT7981> bdinfo
boot_params = 0x0000000000000000
DRAM bank = 0x0000000000000000
-> start = 0x0000000040000000
-> size = 0x0000000010000000
flashstart = 0x0000000000000000
flashsize = 0x0000000000000000
flashoffset = 0x0000000000000000
baudrate = 115200 bps
relocaddr = 0x000000004ff30000
reloc off = 0x000000000e130000
Build = 64-bit
current eth = ethernet@15100000
ethaddr = 32:86:50:31:3c:83
IP addr = 192.168.1.1
fdt_blob = 0x0000000041e983e0
new_fdt = 0x0000000000000000
fdt_size = 0x0000000000000000
ERROR: reserving fdt memory region failed (addr=4fc00000 size=100000 flags=4)
lmb_dump_all:
memory.cnt = 0x1 / max = 0x40
memory[0] [0x40000000-0x4fffffff], 0x10000000 bytes flags: 0
reserved.cnt = 0x3 / max = 0x40
reserved[0] [0x42ff0000-0x42ffffff], 0x00010000 bytes flags: 0
reserved[1] [0x43000000-0x4302ffff], 0x00030000 bytes flags: 4
reserved[2] [0x4f7faea0-0x4fffffff], 0x00805160 bytes flags: 0
devicetree = embed
arch_number = 0x0000000000000000
TLB addr = 0x000000004fff0000
irq_sp = 0x000000004f7ffd90
sp start = 0x000000004f7ffd90
Early malloc usage: a18 / 4000
MT7981> env print
boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
bootargs=console=ttyS0,115200n8 console_msg_format=syslog
bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
bootconf=config-1
bootdelay=3
bootfile=openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-initramfs-recovery.itb
bootfile_bl2=openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-preloader.bin
bootfile_fip=openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip
bootfile_upg=openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-squashfs-sysupgrade.itb
bootled_pwr=yellow:status
bootled_rec=blue:status
bootmenu_0=Run default boot command.=run boot_default
bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
bootmenu_8=Reboot.=reset
bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
bootmenu_default=0
bootmenu_delay=3
bootmenu_title= ( ( ( OpenWrt ) ) ) U-Boot 2024.07-OpenWrt-r27433-7e1d092552 (Sep 16 2024 - 20:47:44 +0000)
console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
ethact=ethernet@15100000
ethaddr=32:86:50:31:3c:83
ipaddr=192.168.1.1
loadaddr=0x46000000
mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
replacevol=1
reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
serverip=192.168.1.254
ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
ver=U-Boot 2024.07-OpenWrt-r27433-7e1d092552 (Sep 16 2024 - 20:47:44 +0000)
mtd list
List of MTD devices:
* spi-nand0
- device: spi_nand@0
- parent: spi@1100a000
- driver: spi_nand
- path: /spi@1100a000/spi_nand@0
- type: NAND flash
- block size: 0x20000 bytes
- min I/O: 0x800 bytes
- OOB size: 64 bytes
- OOB available: 56 bytes
- 0x000000000000-0x000008000000 : "spi-nand0"
- 0x000000000000-0x000000100000 : "bl2"
- 0x000000100000-0x000000140000 : "Nvram"
- 0x000000140000-0x000000180000 : "Bdata"
- 0x000000180000-0x000000380000 : "factory"
- 0x000000380000-0x000000580000 : "fip"
- 0x000000580000-0x0000005c0000 : "crash"
- 0x0000005c0000-0x000000600000 : "crash_log"
- 0x000000600000-0x000007600000 : "ubi"
- 0x000007600000-0x000007640000 : "KF"
bootmenu
( ( ( OpenWrt ) ) ) U-Boot 2024.07-OpenWrt-r27433-7e1d092552 (Sep 16 2024 - 20:47:44 +0000)
1. Run default boot command.
2. Boot system via TFTP.
3. Boot production system from NAND.
4. Boot recovery system from NAND.
5. Load production system via TFTP then write to NAND.
6. Load recovery system via TFTP then write to NAND.
7. Load BL31+U-Boot FIP via TFTP then write to NAND.
8. Load BL2 preloader via TFTP then write to NAND.
9. Reboot.
a. Reset all settings to factory defaults.
0. Exit
I need help from experts to go back to a working state 
(I have a backup).
Let me know if you need more information to establish a diag.
I suppose I must restore FIT first ? But I'm not a router expert, how to transfert the required file without working ethernet ports (port is up but no data from the router itself) ?
Or I will need to recover my backup with SPI tools ? Is there a tutorial for that ? (I saw this post but @rasorocks didn't detailed which SPI programmer he used and how to plug it. I suppose that I will have to investigate on the 25N01KVZEIR and solder directly on it...
Thank you.
I managed to recover via UART, now i have openwrt u-boot layout. 100% satisfaction.
I was on "system halt!" boot message after trying the SSH method on RD23
so continued debricking with UART method step 5, the fun begins. I've used mtk_uartboot TFTP combo and the rest of the guide.
In the end flashed the openwrt-23.05.4-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-* files that I checked the sha256sum before from inside the openwrt u-boot bootloader again
Load BL2 preloader via TFTP then write to NAND
Load BL31+U-Boot FIP via TFTP then write to NAND
the 8, 7, 6, 5 all the steps that write to NAND.
and reboot.
now I have a full working&tested uboot-mod recovery + working system.
last step was to flash Factory.bin from the backup and wifi eeprom error is gone from kernel log.
This looks similar to the this post.
Please see details here and here.
But please make sure to use only your original backup files during the mtd write /tmp/Factory/bin Factory command execution (in order to avoid changed MAC addresses).
The problem is that I have only access to UART recovery boot without access to ethernet so only mtd command line is working (no opkg or insmod) and I don't see how to transfert a file from this mode if I don't have TFTP available...
Unfortunately, just like the RD23 model which lacks official firmware available, the RD03 also doesn't have the 1.0.84 stock firmware published yet (please correct me if i'm wrong). So, restoring to the stock firmware is not yet possible.
It might be better to leave your bricked rd03 for now, and wait until either the 1.0.84 stock firmware is released or OpenWrt support for the new AN8855 hardware becomes available.
update added:
just realized that even when the new firmware is released, it wonât fix the current issue with your ethernet ports not working (since there is already no functioning driver for the AN8855 on the router), which completely stops you from transferring either the stock or OpenWrt firmware to the router.
1 Like
No, I havenât. Some problems with âincorrectâ MAC addresses? After a week of use - I have no problem with router.
I saw somewhere that itâs possible to change it directly with hex viewer, but I havenât to do it.
No, I've never led my RD23 to a soft brick "System halt!" state. But I noticed that this issue sometimes occurs for others.
There is this firmware :
http://cdn.cnbj1.fds.api.mi-img.com/xiaoqiang/rom/rd03/miwifi_rd03_firmware_f85f9_1.0.84.bin
(Not useful for my problem but still be interesting for some users when used with the official restore tool)
But I suppose that I need a full SPI dump if I want to restore with my ch341a programmer and NeoProgrammer. I have an another router at work in 1.0.84 which is not totally bricked like this one, I will dump the 25N01KVZEIR and I will try to restore it on the bricked one.
Then if everything is OK I will try to restore my backup (I suppose that my mac is contained in one of the backuped files 
)
I'll share the dump if it works.
1 Like
Stock firmware RD23 v1.0.49 (Jun 2024): http://cdn.ksyru0-fusion.fds.api.mi-img.com/xiaoqiang/rom/rd23/miwifi_rd23_firmware_153e1_1.0.49_INT.bin
Vulnerability start_binding allowed.
1 Like
This is great news for RD23 users!
Thanks for sharing.
Finally, returning to stock firmware will be possible for the Global version of AX3000T!
update:
stock firmware URLs have been added to the Wiki
1 Like