Xiaomi AX3600 recovery

Hello everyone I love using OpenWRT, and using it for years.

I have a problem with my Xiaomi AX3600 router and at this point I kind of lost hope

I attempted to install OpenWRT following instructions from here , unfortunately after the command "ubiformat /dev/mtd13 -y -f /tmp/openwrt-ipq-ipq807x_64-xiaomi_ax3600-squashfs-nand-factory.bin" there was a power outage and the router become bricked

These were the logs using SERIAL port

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 5.4.89 (li@ubuntu) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r0+11968-bfbcb2c716)) #0 SMP PREEMPT Thu Mar 4 14:12:48 2021
[    0.000000] Machine model: XIAOMI AX3600
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] psci: OSI mode supported.
[    0.000000] percpu: Embedded 24 pages/cpu s58968 r8192 d31144 u98304
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 97524
[    0.000000] Kernel command line: ubi.mtd=rootfs_1 root=mtd:ubi_rootfs rootfstype=squashfs rootwait uart_en=1 ubi.mtd=rootfs_1 root=/dev/ubiblock0_1 rootfstype=squashfs
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 367828K/396288K available (6782K kernel code, 532K rwdata, 2312K rodata, 512K init, 302K bss, 28460K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000]  Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[    0.000000] random: get_random_bytes called from start_kernel+0x340/0x4c0 with crng_init=0
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 19.20MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x46d987e47, max_idle_ns: 440795202767 ns
[    0.000005] sched_clock: 56 bits at 19MHz, resolution 52ns, wraps every 4398046511078ns
[    0.000450] Calibrating delay loop (skipped), value calculated using timer frequency.. 38.40 BogoMIPS (lpj=192000)
[    0.000464] pid_max: default: 32768 minimum: 301
[    0.000584] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.000597] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.001738] ASID allocator initialised with 65536 entries
[    0.001818] rcu: Hierarchical SRCU implementation.
[    0.003665] MSM Memory Dump base table set up
[    0.003687] MSM Memory Dump apps data table set up
[    0.003868] smp: Bringing up secondary CPUs ...
[    0.004417] Detected VIPT I-cache on CPU1
[    0.004473] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.005045] Detected VIPT I-cache on CPU2
[    0.005082] CPU2: Booted secondary processor 0x0000000002 [0x410fd034]
[    0.005594] Detected VIPT I-cache on CPU3
[    0.005626] CPU3: Booted secondary processor 0x0000000003 [0x410fd034]
[    0.005699] smp: Brought up 1 node, 4 CPUs
[    0.005721] SMP: Total of 4 processors activated.
[    0.005729] CPU features: detected: 32-bit EL0 Support
[    0.005736] CPU features: detected: CRC32 instructions
[    0.005780] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.005789] CPU: All CPU(s) started at EL1
[    0.006072] alternatives: patching kernel code
[    0.018362] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.018385] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.018517] pinctrl core: initialized pinctrl subsystem
[    0.019379] NET: Registered protocol family 16
[    0.019769] DMA: preallocated 256 KiB pool for atomic allocations
[    0.020257] cpuidle: using governor ladder
[    0.020283] cpuidle: using governor menu
[    0.020432] NET: Registered protocol family 42
[    0.020634] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[    0.067686] spmi spmi-0: PMIC arbiter version v2 (0x20010000)
[    0.087006] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 2
[    0.088930] msm_sps_probe: sps:sps is ready
[    1.937950] pps_core: LinuxPPS API ver. 1 registered
[    1.937962] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[    1.937981] PTP clock support registered
[    1.938786] workqueue: max_active 576 requested for napi_workq is out of range, clamping between 1 and 512
[    1.939579] clocksource: Switched to clocksource arch_sys_counter
[    1.940301] thermal_sys: Registered thermal governor 'step_wise'
[    1.940306] thermal_sys: Registered thermal governor 'user_space'
[    1.942416] NET: Registered protocol family 2
[    1.942959] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    1.942981] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    1.943030] TCP bind hash table entries: 4096 (order: 4, 65536 bytes, linear)
[    1.943107] TCP: Hash tables configured (established 4096 bind 4096)
[    1.943190] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    1.943216] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    1.943356] NET: Registered protocol family 1
[    1.943385] PCI: CLS 0 bytes, default 64
[    1.944507] hw perfevents: enabled with armv8_cortex_a53 PMU driver, 7 counters available
[    1.945401] Initialise system trusted keyrings
[    1.945543] workingset: timestamp_bits=62 max_order=17 bucket_order=0
[    1.950085] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.950094] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.970599] Key type asymmetric registered
[    1.970608] Asymmetric key parser 'x509' registered
[    1.971259] qcom-qmp-phy 78000.ssphy: 78000.ssphy supply vdda-phy not found, using dummy regulator
[    1.971331] qcom-qmp-phy 78000.ssphy: 78000.ssphy supply vdda-pll not found, using dummy regulator
[    1.972340] qcom-qmp-phy 78000.ssphy: Registered Qcom-QMP phy
[    1.972492] qcom-qmp-phy 58000.ssphy: 58000.ssphy supply vdda-phy not found, using dummy regulator
[    1.972550] qcom-qmp-phy 58000.ssphy: 58000.ssphy supply vdda-pll not found, using dummy regulator
[    1.973433] qcom-qmp-phy 58000.ssphy: Registered Qcom-QMP phy
[    1.974376] qcom-qmp-phy 84000.phy: Registered Qcom-QMP phy
[    1.974464] qcom-qmp-phy: probe of 86000.phy failed with error -13
[    1.976417] bam-dma-engine 704000.dma: num-channels unspecified in dt
[    1.976428] bam-dma-engine 704000.dma: num-ees unspecified in dt
[    1.979284] msm-dcc b3000.dcc: DCC XPU is not specified
[    1.979512] msm-dcc b3000.dcc: jiffies_64: 0xffff8b94, cntvct_64: 0xd1d07e7
[    1.979525] msm-dcc b3000.dcc: gcnt_hi: 0x00000000(0x(____ptrval____))
[    1.979536] msm-dcc b3000.dcc: gcnt_lo: 0x0d1d09c9(0x(____ptrval____))
[    1.980297] CPU: IPQ8071A, SoC Version: 2.0
[    1.980758] msm_rpm_log_probe: OK
[    1.981045] TZ SMMU State: Can't detect SMMU State
[    1.981109] TZ Log : Will warn on Access Violation, as paniconaccessviolation is not set
[    1.981981] pmd9655_s3: supplied by e-smps1-reg
[    1.982268] pmd9655_s4: supplied by e-smps1-reg
[    1.982581] pmd9655_ldo11: supplied by e-smps1-reg
[    1.983109] msm_serial 78b3000.serial: msm_serial: detected port #0
[    1.983144] msm_serial 78b3000.serial: uartclk = 3686400
[    1.983200] 78b3000.serial: ttyMSM0 at MMIO 0x78b3000 (irq = 12, base_baud = 230400) is a MSM
[    1.983222] msm_serial: console setup on port #0
[    2.661575] printk: console [ttyMSM0] enabled
[    2.666517] msm_serial: driver initialized
[    2.670812] random: fast init done
[    2.674677] random: crng init done
[    2.680561] brd: module loaded
[    2.684426] loop: module loaded
[    2.686153] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xaa
[    2.687335] nand: ESMT GD9FS2G8F2A
[    2.693948] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 128
[    2.697247] 17 fixed-partitions partitions found on MTD device qcom_nand.0
[    2.704707] Creating 17 MTD partitions on "qcom_nand.0":
[    2.711652] 0x000000000000-0x000000100000 : "0:SBL1"
[    2.718538] 0x000000100000-0x000000200000 : "0:MIBIB"
[    2.723470] 0x000000200000-0x000000500000 : "0:QSEE"
[    2.730054] 0x000000500000-0x000000580000 : "0:DEVCFG"
[    2.732984] 0x000000580000-0x000000600000 : "0:RPM"
[    2.737932] 0x000000600000-0x000000680000 : "0:CDT"
[    2.742802] 0x000000680000-0x000000700000 : "0:APPSBLENV"
[    2.747585] 0x000000700000-0x000000800000 : "0:APPSBL"
[    2.753590] 0x000000800000-0x000000880000 : "0:ART"
[    2.758223] 0x000000880000-0x000000900000 : "bdata"
[    2.762974] 0x000000900000-0x000000980000 : "crash"
[    2.767806] 0x000000980000-0x000000a00000 : "crash_syslog"
[    2.772701] 0x000000a00000-0x000002dc0000 : "rootfs"
[    2.808352] mtd: device 12 (rootfs) set to be root filesystem
[    2.808643] mtdsplit: no squashfs found in "rootfs"
[    2.813100] 0x000002dc0000-0x00000adc0000 : "rootfs_1"
[    2.927507] 0x00000adc0000-0x00000cc80000 : "overlay"
[    2.954381] 0x00000cc80000-0x00000cd00000 : "rsvd0"
[    2.955390] 0x00000cd00000-0x00000d600000 : "0:WIFIFW"
[    2.967077] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    2.967696] spi-nor spi0.0: unrecognized JEDEC id bytes: ff ff ff ff ff ff
[    2.974176] libphy: Fixed MDIO Bus: probed
[    3.200307] qca-mdio 90000.mdio: Could not find phy-reset-gpio
[    3.200445] libphy: qca_mdio: probed
[    3.206478] qca-mdio 90000.mdio: qca-mdio driver was registered
[    3.209027] Unable to create IPC log context!
[    3.214705] Skip QCA8074V1 in V2 platform
[    3.219351] cnss[2]: INFO: Platform driver probed successfully. plat 00000000714322ac tgt 0xfffe
[    3.223104] i2c /dev entries driver
[    3.236195] sdhci: Secure Digital Host Controller Interface driver
[    3.236221] sdhci: Copyright(c) Pierre Ossman
[    3.241277] sdhci-pltfm: SDHCI platform and OF driver helper
[    3.246082]
[    3.246082] Version Rollback Feature Disabled
[    3.252665] remoteproc remoteproc0: cd00000.q6v5_wcss is available
[    3.257360] SPMI VADC - Min ch: 0 Max ch: 15
[    3.265136] coresight-tmc 6027000.tmc: failed to get flush cti, defer probe
[    3.267904] coresight-dynamic-funnel 6021000.funnel: Uses obsolete Coresight DT bindings
[    3.276084] coresight coresight-etm0: CPU0: ETM v4.0 initialized
[    3.282694] coresight-etm4x 619c000.etm: CPU0: (null) initialized
[    3.289015] coresight coresight-etm1: CPU1: ETM v4.0 initialized
[    3.294669] coresight-etm4x 619d000.etm: CPU1: (null) initialized
[    3.301090] coresight coresight-etm2: CPU2: ETM v4.0 initialized
[    3.306718] coresight-etm4x 619e000.etm: CPU2: (null) initialized
[    3.313163] coresight coresight-etm3: CPU3: ETM v4.0 initialized
[    3.318784] coresight-etm4x 619f000.etm: CPU3: (null) initialized
[    3.325085] coresight-stm 6002000.stm: coresight-stm : stm_register_device failed, probing deferred
[    3.330976] OF: graph: no port node found in /soc/cti@6010000
[    3.339896] OF: graph: no port node found in /soc/cti@6011000
[    3.345775] OF: graph: no port node found in /soc/cti@6012000
[    3.351522] OF: graph: no port node found in /soc/cti@6013000
[    3.357235] OF: graph: no port node found in /soc/cti@6014000
[    3.362981] OF: graph: no port node found in /soc/cti@6015000
[    3.368704] OF: graph: no port node found in /soc/cti@6016000
[    3.374437] OF: graph: no port node found in /soc/cti@6017000
[    3.380165] OF: graph: no port node found in /soc/cti@6018000
[    3.385883] OF: graph: no port node found in /soc/cti@6019000
[    3.391626] OF: graph: no port node found in /soc/cti@601a000
[    3.397339] OF: graph: no port node found in /soc/cti@601b000
[    3.403093] OF: graph: no port node found in /soc/cti@601c000
[    3.408798] OF: graph: no port node found in /soc/cti@601d000
[    3.414545] OF: graph: no port node found in /soc/cti@601e000
[    3.420273] OF: graph: no port node found in /soc/cti@601f000
[    3.425993] OF: graph: no port node found in /soc/cti@6198000
[    3.431745] OF: graph: no port node found in /soc/cti@6199000
[    3.437445] OF: graph: no port node found in /soc/cti@619a000
[    3.443197] OF: graph: no port node found in /soc/cti@619b000
[    3.448912] OF: graph: no port node found in /soc/cti@610c000
[    3.455477] OF: graph: no port node found in /soc/hwevent@6101000
[    3.460208] coresight-hwevent 6101000.hwevent: No csr data
[    3.466544] OF: graph: no port node found in /soc/csr@6001000
[    3.471760] coresight-csr 6001000.csr: CSR initialized: coresight-csr
[    3.478361] NET: Registered protocol family 10
[    3.484743] Segment Routing with IPv6
[    3.488282] NET: Registered protocol family 17
[    3.492033] Bridge firewalling registered
[    3.496293] 8021q: 802.1Q VLAN Support v1.8
[    3.500698] Loading compiled-in X.509 certificates
[    3.522366] qcom,cpr4-apss-regulator b018000.cpr4-ctrl: CPR valid fuse count: 2
[    3.522617] cpr4_ipq807x_apss_read_fuse_data: apc_corner: speed bin = 0
[    3.528482] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR fusing revision = 1
[    3.535111] cpr4_ipq807x_apss_read_fuse_data: apc_corner: CPR misc fuse value = 0
[    3.542755] cpr4_ipq807x_apss_read_fuse_data: apc_corner: Voltage boost fuse config = 0 boost = disable
[    3.550257] cpr3_mem_acc_init: apc: not using memory accelerator regulator
[    3.559386] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      SVS: open-loop= 704000 uV
[    3.566349] cpr4_ipq807x_apss_calculate_open_loop_voltages: apc_corner: fused      NOM: open-loop= 832000 uV
[    3.576381] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      SVS: quot[ 7]= 707, quot_offset[ 7]=   0
[    3.586144] cpr4_ipq807x_apss_calculate_target_quotients: apc_corner: fused      NOM: quot[ 7]= 945, quot_offset[ 7]= 235
[    3.597113] cpr3_regulator_init_ctrl: apc: Default CPR mode = closed-loop
[    3.598458] cpufreq: cpufreq_online: CPU0: Running at unlisted freq: 800000 KHz
[    3.614919] cpufreq: cpufreq_online: CPU0: Unlisted initial frequency changed to: 1017600 KHz
[    3.622128] sps_register_bam_device: sps:BAM 0x0000000006044000 is registered
[    3.631213] coresight coresight-stm: STM32 initialized
[    3.637826] ubi0: attaching mtd13
[    4.190470] ubi0: scanning is finished
[    4.196368] ubi0: attached mtd13 (name "rootfs_1", size 128 MiB)
[    4.196390] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    4.201442] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    4.208115] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    4.214980] ubi0: good PEBs: 1024, bad PEBs: 0, corrupted PEBs: 0
[    4.221749] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[    4.227995] ubi0: max/mean erase counter: 21/18, WL threshold: 4096, image sequence number: 468035124
[    4.235124] ubi0: available PEBs: 0, total reserved PEBs: 1024, PEBs reserved for bad PEB handling: 40
[    4.244421] ubi0: background thread "ubi_bgt0d" started, PID 95
[    4.244428] ubi: mtd13 is already attached to ubi0
[    4.259412] UBI error: cannot attach mtd13
[    4.264933] block ubiblock0_1: created from ubi0:1(rootfs)
[    4.268361] hctosys: unable to open rtc device (rtc0)
[    4.277351] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    4.309650] Run /sbin/init as init process
[    4.458122] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 56320 bytes from PEB 80:69632, read only 56320 bytes, retry
[    4.464635] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 56320 bytes from PEB 80:69632, read only 56320 bytes, retry
[    4.475635] ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 56320 bytes from PEB 80:69632, read only 56320 bytes, retry
[    4.487698] ubi0 error: ubi_io_read: error -74 (ECC error) while reading 56320 bytes from PEB 80:69632, read 56320 bytes
[    4.493249] CPU: 0 PID: 99 Comm: kworker/0:2 Not tainted 5.4.89 #0
[    4.504248] Hardware name: XIAOMI AX3600 (DT)
[    4.510241] Workqueue: ubiblock0_1 ubiblock_do_work
[    4.514662] Call trace:
[    4.519350]  dump_backtrace+0x0/0x15c
[    4.521780]  show_stack+0x14/0x1c
[    4.525599]  dump_stack+0xb4/0xf8
[    4.528896]  ubi_io_read+0x254/0x350
[    4.532195]  ubi_eba_read_leb+0x31c/0x41c
[    4.535843]  ubi_eba_read_leb_sg+0xdc/0x140
[    4.539748]  ubi_leb_read_sg+0xc0/0x11c
[    4.543741]  ubiblock_do_work+0x8c/0xdc
[    4.547564]  process_one_work+0x194/0x270
[    4.551381]  worker_thread+0x200/0x314
[    4.555547]  kthread+0x130/0x140
[    4.559192]  ret_from_fork+0x10/0x18
[    4.562600] blk_update_request: I/O error, dev ubiblock0_1, sector 10538 op 0x0:(READ) flags 0x0 phys_seg 58 prio class 0
[    4.566163] SQUASHFS error: squashfs_read_data failed to read block 0x525392
[    4.577047] SQUASHFS error: Unable to read fragment cache entry [525392]
[    4.584119] SQUASHFS error: Unable to read page, block 525392, size e4fc
[    4.590806] SQUASHFS error: Unable to read fragment cache entry [525392]
[    4.597479] SQUASHFS error: Unable to read page, block 525392, size e4fc
[    4.604171] SQUASHFS error: Unable to read fragment cache entry [525392]
[    4.610853] SQUASHFS error: Unable to read page, block 525392, size e4fc
[    4.617532] SQUASHFS error: Unable to read fragment cache entry [525392]
[    4.624222] SQUASHFS error: Unable to read page, block 525392, size e4fc
[    4.630909] SQUASHFS error: Unable to read fragment cache entry [525392]
[    4.637583] SQUASHFS error: Unable to read page, block 525392, size e4fc
Error loading shared library libubus.so: I/O error (needed by /sbin/init)
[    4.673482] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00007f00
[    4.673517] CPU: 0 PID: 1 Comm: init Not tainted 5.4.89 #0
[    4.679936] Hardware name: XIAOMI AX3600 (DT)
[    4.685491] Call trace:
[    4.689922]  dump_backtrace+0x0/0x15c
[    4.692174]  show_stack+0x14/0x1c
[    4.695995]  dump_stack+0xb4/0xf8
[    4.699294]  panic+0x164/0x350
[    4.702591]  do_exit+0x17c/0x854
[    4.705541]  __arm64_sys_exit_group+0x0/0x14
[    4.708928]  __wake_up_parent+0x0/0x28
[    4.713184]  el0_svc_common.constprop.0+0x84/0x100
[    4.716742]  el0_svc_handler+0x18/0x20
[    4.721513]  el0_svc+0x8/0x1b4
[    4.725249] SMP: stopping secondary CPUs
[    4.728330] The reading for sensor 4 is 0x00204146
[    4.732368] The reading for sensor 5 is 0x00205146
[    4.737025] Couldn't get reading for sensor 6
[    4.741743] The reading for sensor 7 is 0x00207146
[    4.746171] The reading for sensor 8 is 0x00208142
[    4.750914] Couldn't get reading for sensor 9
[    4.755632] The reading for sensor 10 is 0x0020a14f
[    4.760115] Couldn't get reading for sensor 11
[    4.764747] The reading for sensor 12 is 0x0020c156
[    4.769261] The reading for sensor 13 is 0x0020d153
[    4.774089] Couldn't get reading for sensor 14
[    4.778895] The reading for sensor 15 is 0x0020f142
[    4.783407] Kernel Offset: disabled
[    4.788180] CPU features: 0x0002,20002000
[    4.791653] Memory Limit: none
[    4.795851] Rebooting in 5 seconds..

I attempted to recover using this tutorial off course using 1.0.17 firmware for AX3600 the problem here is that it always fails.

A few seconds after the firmware is uploaded to the router the orange light turs off and the system blue light blinks infinitely.

I have the following questions:

  1. Am I doing something wrong ?
  2. If not is there something else I can try ? (serial is no longer working after the first attempt of using recovery mode flashing)
  3. Is the router permanently bricked ?

reboot, hit any key stop auto boot
set your ip to 192.168.31.100
uboot command
tftpb openwrt-ipq-ipq807x_64-xiaomi_ax3600-squashfs-nand-factory.bin
flash rootfs_1
reset

2 Likes

Tried to stop it from auto booting but nothing I did worked (pressing keys), the only thing seams to be working is by shorting TX pin to the GND but that does not give me write access.
I am thinking that what I am using to interface to serial is not good.

Currently I am using an old Prolific USB-to-Serial that has a PL2303 chip and Putty as software

I was able to stop autoboot by changing the usb to serial adapter and connecting it 2 sec later after router power on.
Now I am facing another roadblock, the command "flash rootfs1" does nothing.

I was able to capture logs from the recovery mode using Xiaomi recovery tool

  restore_defaults is set, enlarge xqup detect time
 detect button press, continue check 15 secs
 detect button pressed 15 secs !
 confirm to launch xq_upgrade !
 cmd=dhcp

Net:   MAC0 addr:28:d1:27:4d:43:cf
PHY ID1: 0x4d
PHY ID2: 0xd0b1
EDMA ver 1 hw init
Num rings - TxDesc:1 (0-0) TxCmpl:1 (7-7)
RxDesc:1 (15-15) RxFill:1 (7-7)
ipq807x_edma_alloc_rings: successfull
ipq807x_edma_setup_ring_resources: successfull
ipq807x_edma_configure_rings: successfull
ipq807x_edma_hw_init: successfull
board_eth_init: ipq807x_edma_init successed
eth0
ipq807x_eth_halt: done
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :10 Full duplex
eth0 PHY2 up Speed :100 Full duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
eth0 PHY5 Down Speed :10 Half duplex
ipq807x_eth_init: done
BOOTP broadcast 1
*** Unhandled DHCP Option in OFFER/ACK: 7
*** Unhandled DHCP Option in OFFER/ACK: 7
DHCP client bound to address 192.168.31.101 (26 ms)
Using eth0 device
TFTP from server 192.168.31.100; our IP address is 192.168.31.101
Filename 'miwifi_r3600_firmware_5da25_1.0.17.bin'.
Load address: 0x44000000
Loading: *
Got TFTP_OACK: TFTP remote port: changes from 69 to 53558
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#####
572.3 KiB/s
done
Bytes transferred = 28312508 (1b003bc hex)
ipq807x_eth_halt: done
LoadAddr=44000000 NetBootFileXferSize= 1b003bc
CRC verify success!
RSA signature verify success!
Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK
Upgrade xiaoqiang_version...
Upgrade root.ubi...
 --- xq_flash_erase Erasing Nand...0x00a00000~+0x023c0000
Erasing at 0x2da0000 -- 100% complete.
 --- xq_flash_erase Erasing Nand...0x02dc0000~+0x023c0000
Erasing at 0x5160000 -- 100% complete.
common/proc_xqimage.c xqimage_upgrade 541 start:0x440002ac,subh->flash_addr:0xff        ffffff,len:0x1b00000
Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK
========Upgrade success!========
Erasing NAND...
Erasing at 0x6e0000 -- 100% complete.
Writing to NAND... OK

After the message " Writing to NAND... OK " the infinite blinking blue light start, but the router still does not boot

My intention is to restore to factory firmware for the moment

after many hours of investigating issues I found out what my issues were.

Thx efsg for pointing to the right direction.

the correct command was flash rootfs_1

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.