Uboot boot loop on Xiaomi AX3000T

Installing and Using OpenWrt
1

Hi, I tried to install OpenWRT on my Xiaomi AX3000T (RD03) router by following the instructions in the Wiki.
Installing OpenWRT itself went fine, but then I tried replacing the built-in bootloader with the OpenWRT uboot. This ended up in an infinite boot loop:

U-Boot 2024.10-OpenWrt-r28427-6df0e3d02a (Feb 03 2025 - 23:09:37 +0000)

CPU:   MediaTek MT7981
Model: Xiaomi Router AX3000T
DRAM:  256 MiB
Core:  39 devices, 17 uclasses, devicetree: embed
Loading Environment from UBI... spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
Partition ubi not found!

** Cannot find mtd partition "ubi"
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
reset button found
Loading Environment from UBI... spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
Partition ubi not found!

** Cannot find mtd partition "ubi"
Net:   
Warning: ethernet@15100000 (eth0) using random MAC address - 06:4b:fa:59:c6:45
eth0: ethernet@15100000
Error, no UBI device selected!
Error, no UBI device selected!
spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
MTD device ubi not found, ret -19
resetting ...

Now I tried to flash via UART using the instructions of @alexq (OpenWrt support for Xiaomi AX3000T - #420 by alexq), but with a very similar result:

mtk_uartboot -s /dev/ttyUSB0 --payload bl2-mt7981-bga-ddr3-ram.bin  --aarch64 --fip openwrt-24.10.0-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip && screen /dev/ttyUSB0 115200

mtk_uartboot - 0.1.1
Using serial port: /dev/ttyUSB0
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0x8f29
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.10.0   (release):v2.10.0-mtk
NOTICE:  BL2: Built : 13:17:06, Mar  1 2024
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE:  Received FIP 0xde099 @ 0x40400000 ...
==================================

Screen starts now:

NOTICE:  BL31: v2.10.0        (release):OpenWrt v2024.01.17~bacca82a-3 (mt7981-spim-nand-ddr3)
NOTICE:  BL31: Built : 23:09:37, Feb  3 2025


U-Boot 2024.10-OpenWrt-r28427-6df0e3d02a (Feb 03 2025 - 23:09:37 +0000)

CPU:   MediaTek MT7981
Model: Xiaomi Router AX3000T
DRAM:  256 MiB
Core:  39 devices, 17 uclasses, devicetree: embed
Loading Environment from UBI... spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
Partition ubi not found!

** Cannot find mtd partition "ubi"
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
reset button found
Loading Environment from UBI... spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
Partition ubi not found!

** Cannot find mtd partition "ubi"
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - 1e:6d:85:b5:23:8c
eth0: ethernet@15100000
Error, no UBI device selected!
Error, no UBI device selected!
spi-nand: spi_nand spi_nand@0: unknown raw ID cd 71 71 cd
MTD device ubi not found, ret -19
resetting ...

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0236 [010F]
Jump to BL

Pressing ctrl+c, escape, or any other keys does not interrupt the boot loop. It notices when I hold the hardware reset button down, but this also seems to change nothing. I cannot see that it would ever try to fetch data from tftp:

dnsmasq --no-daemon --listen-address=192.168.1.254 --bind-interfaces --dhcp-range=192.168.1.2,192.168.1.253 --enable-tftp --tftp-root=$PWD --log-dhcp --log-facility=- -d -q --log-queries

What is the issue here?
What can I do now to unbrick my router?

Any help will be highly appreciated :slight_smile:

2

I can assume you have Foresee NAND flash chip on your RD03.

Which bootloader files did you use during the flashing of the OpenWrt U-Boot bootloader? Please confirm that you've followed the warning clarification from Wiki and:

  1. downloaded "bl31-uboot.fip FIP" and "preloader.bin BL2" file from Snapshot: here
  2. downloaded other files from 24.10.0: here

If you didn't use the "bl31-uboot.fip FIP" and "preloader.bin BL2" files from the Snapshot, try using them during UART, as they contain the driver for your Foresee NAND chip.

3

Amazing! That makes a lot of sense, it is working now :tada:

For reference, my procedure was the following:

  • mtk_uartboot -s /dev/ttyUSB0 --payload bl2-mt7981-bga-ddr3-ram.bin --aarch64 --fip openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip && screen /dev/ttyUSB0 115200

    -> This gave me a working uboot boot menu

  • Within the uboot boot menu:

    • press 8 to flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-preloader.bin from TFTP
    • press 7 to flash openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip from TFTP
    • Afterwards, reboot the router

  • Now I could flash the production and recovery environments with the actual OpenWRT v24.10 image from TFTP, using the freshly installed uboot bootloader on the router :tada:

Thanks a lot for the hint @alexq :+1:
Small mistake, big effect ^^

1 Like
4

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.