Xiaomi AX3000T mtk_uartboot - tftp cannot load

mici · October 19, 2025, 11:58am

Hi,
An AX3000T soft-bricked.
Serial log:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024F [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):e233a3d581-dirty
NOTICE:  BL2: Built : 06:23:27, Jul 30 2023
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a003f1 000000ff 00100000 00000000
1001d040 | 00027e71 000200a0 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0xc
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 588, worse bit 0, min window 72
Window Sum 576, worse bit 11, min window 68
Window Sum 370, worse bit 0, min window 44
Window Sum 302, worse bit 15, min window 32
Window Sum 372, worse bit 7, min window 44
Window Sum 308, worse bit 9, min window 36
Window Sum 384, worse bit 2, min window 46
Window Sum 326, worse bit 15, min window 36
Window Sum 332, worse bit 15, min window 36
Window Sum 404, worse bit 7, min window 48
Window Sum 342, worse bit 9, min window 40
Window Sum 352, worse bit 15, min window 40
Window Sum 364, worse bit 15, min window 42
Window Sum 366, worse bit 8, min window 44
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xc8
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):e233a3d581-dirty
NOTICE:  BL31: Built : 06:23:27, Jul 30 2023
NOTICE:  Hello BL31!!!

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024F [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):e233a3d581-dirty
NOTICE:  BL2: Built : 06:23:27, Jul 30 2023
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a003f1 000000ff 00100000 00000000
1001d040 | 00027e71 000200a0 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0xc
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 576, worse bit 0, min window 72
Window Sum 576, worse bit 11, min window 68
Window Sum 370, worse bit 1, min window 44
Window Sum 308, worse bit 15, min window 34
Window Sum 376, worse bit 0, min window 46
Window Sum 316, worse bit 15, min window 36
Window Sum 384, worse bit 0, min window 46
Window Sum 322, worse bit 15, min window 36
Window Sum 394, worse bit 0, min window 48
Window Sum 336, worse bit 15, min window 38
Window Sum 396, worse bit 0, min window 48
Window Sum 346, worse bit 15, min window 40
Window Sum 352, worse bit 15, min window 40
Window Sum 404, worse bit 3, min window 48
Window Sum 364, worse bit 15, min window 42
Window Sum 366, worse bit 9, min window 42
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xc8
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
NOTICE:  BL31: v2.6(release):e233a3d581-dirty
NOTICE:  BL31: Built : 06:23:27, Jul 30 2023
NOTICE:  Hello BL31!!!

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024F [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):e233a3d581-dirty
NOTICE:  BL2: Built : 06:23:27, Jul 30 2023
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a003f1 000000ff 00100000 00000000
1001d040 | 00027e71 000200a0 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0xc
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 596, worse bit 1, min window 72
Window Sum 96, worse bit 8, min window 12
Window Sum 350, worse bit 6, min window 38
Window Sum 362, worse bit 6, min window 42
Window Sum 380, worse bit 1, min window 46
NOTICE:  EMI: Detected DRAM size: 0MB

I tried debrick via 'official' solution by alexq, but...
I tried this solution too https://forum.openwrt.org/t/uboot-boot-loop-on-xiaomi-ax3000t/227583/2 but after a resetting line start again the Hello BL31!!! loop for NOTICE: EMI: Detected DRAM size: 0MB line.
So, I can't connect to router via tftp for update an itb file.
The payload upload's log:

> C:\AX3000T\mtk_uartbootv>mtk_uartboot.exe -s COM3 --aarch64 -p bl2-mt7981-bga-ddr3-ram.bin -f openwrt-mediatek-filogic-xiaomi_mi-router-ax3000t-ubootmod-bl31-uboot.fip && putty -serial COM3 -sercfg 115200,8,n,1,N
mtk_uartboot - 0.1.1
Using serial port: COM3
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0x8f29
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.10.0   (release):v2.10.0-mtk
NOTICE:  BL2: Built : 13:17:06, Mar  1 2024
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE:  Received FIP 0xc46b4 @ 0x40400000 ...
==================================

The received fip not compatible for my HW or something else went wrong?
Sorry for my basic English.

frollic · October 21, 2025, 5:57am

mtk_uartboot doesn't write anything to flash, simply sending stuff to the router using it won't fix anything.

mici · October 24, 2025, 12:38am

True. As I wrote, the router is softbricked. In this state, the above log can be read on the COM port.
I followed this description and I found that the upload is completed, the fip file is evaluated as uploaded (the lower log shows this), but after about 15-20 seconds a "resetting" line appears and the Hello BL31!!! loop appears, as in the upper log. I interpret this as meaning that the upload is successful, but it does not execute the contents of the fip file (network configuration for tftp) and the router restarts itself. But why?
What method can I use to find out?
Now I'm trying with a serial sniffer.