小米AX3000T用TTL编程器救砖教程/超简易版/傻瓜式/支持V1V2版本-勇爱设计Netwrok

核心原理

正常刷机：一般是在路由器的网页管理界面直接上传固件，操作简单，但如果路由器变砖（无法启动、进不了管理页），或者官方锁了刷机功能，这条路就走不通了。
TTL 刷机：TTL 是路由器主板上的一个硬件调试接口，相当于路由器的 “后门”。用 TTL 线连接这个接口和电脑的串口 / USB 口，就能直接和路由器的底层系统通信，不管路由器能不能正常开机，都能通过命令行推送新固件，救砖或者刷第三方系统。

一句话总结TTL 路由器刷机 = 拆机接一根线，用电脑给路由器 “强行装系统”，是救砖和突破刷机限制的实用方法。

路由器刷机变砖的主要原因可以归结为以下几类：

1. 固件不匹配或错误

   刷了不适合该路由器型号或硬件版本的固件是最常见的变砖原因。例如，不同品牌、不同芯片方案（如MTK、博通、高通）之间的固件互不兼容，刷入后系统无法正常启动 。

2. 刷机过程中断电或中断

   刷机时如果电源突然断开、网络中断或用户误操作，可能导致固件写入不完整，造成系统损坏或Bootloader损坏，从而无法启动 。

3. Bootloader损坏

   刷机时误刷了不兼容的Bootloader（如BREED、U-Boot），或者刷写过程中出错，会导致路由器无法加载系统，表现为完全无反应或指示灯异常 。

4. 第三方固件不稳定或未经验证

   使用未经充分测试的第三方固件（如某些自编译版本）可能存在兼容性问题或隐藏Bug，导致系统启动失败或反复重启 。

5. 未正确清除旧配置或NVRAM损坏

   刷机前未清除旧配置，或刷机过程中NVRAM分区损坏，可能导致系统配置冲突，从而无法进入系统 。

6. 硬件问题（如坏块、电源不稳）

   某些路由器使用NAND闪存，存在坏块管理机制（如nmbm），若刷入不支持该机制的固件，可能导致坏块信息丢失，从而变砖 。

7. 操作失误或教程误导

   盲目跟随非官方或错误的刷机教程，如未正确进入刷机模式、未使用正确工具（如TFTP、TTL）等，也容易导致刷机失败 。

---

如需避免变砖，建议刷机前务必确认固件与设备型号完全匹配，备份原厂固件，使用稳定电源，并严格按照教程操作。

🛠️ 必备工具

USB-TTL 编程器
螺丝刀/刀片/磁卡
一台电脑（Windows10/11）
傻瓜式工具+恢复工具
设备对应的 U-Boot 恢复镜像 / 固件文件

总体思路（UART 救砖）

第一步：连接编程器

拆机，拆下螺丝，用刀片上方撬开再用撬片或磁卡依次撬开
找到主板上的 TTL 串口引脚（ GND, TX, RX, VCC）
编程器使用3.3v连接。接口上的TX插路由的RX，RX插TX，GND插GND，VCC一定不要插，否则可能会烧坏元器件，总共三根线就好了。教程使用的是杜邦线排针，不需要焊接。如图所示就代表连接好了。恭喜本教程最难的一步已经完成，接下来可以傻瓜式操作了。

USB-TTL TXD ——> 路由器 RX
USB-TTL RXD ——> 路由器 TX
USB-TTL GND ——> 路由器 GND
（接 3.3V 供电）

图片[2]-小米AX3000T用TTL编程器救砖教程/超简易版/傻瓜式/支持V1V2版本-勇爱设计Netwrok

放心大胆跟着搞！只要不接VCC，接错了也不会烧坏电路板的！

图片[3]-小米AX3000T用TTL编程器救砖教程/超简易版/傻瓜式/支持V1V2版本-勇爱设计Netwrok

拆下螺丝后用刀片上方撬开缝隙，然后再用撬片/磁卡撬开

图片[4]-小米AX3000T用TTL编程器救砖教程/超简易版/傻瓜式/支持V1V2版本-勇爱设计Netwrok

磁卡撬开左边

图片[5]-小米AX3000T用TTL编程器救砖教程/超简易版/傻瓜式/支持V1V2版本-勇爱设计Netwrok

磁卡撬开左下角

图片[6]-小米AX3000T用TTL编程器救砖教程/超简易版/傻瓜式/支持V1V2版本-勇爱设计Netwrok

就可以打开后盖了

图片[7]-小米AX3000T用TTL编程器救砖教程/超简易版/傻瓜式/支持V1V2版本-勇爱设计Netwrok

黑色线就是杜邦线，带公母排针，不需要焊接。

第二步，刷入uboot

编程器连接电脑,同时路由器断电状态网线连接电脑。打开傻瓜式救砖.bat。

本视频以V2版本为例。点击打开设备管理器，双击端口可以查看电脑的USB的COM口，按照电脑显示填写，例如演示的这台电脑显示是3。回到界面，输入3回车，输入2回车，选择波特率115200。

这时候给路由器插上电源，正常情况就会开始进入自动化流程。如果卡在这个位置不动，常见原因：电脑USB接触不良，TTL接触不良或者错误，硬件损坏等，解决办法断电依据原因重新尝试。自

动化流程这里大概会2分钟左右，不要着急。如果中途出现报错，大概率是第一步的接触不良造成，断电重试即可。关键来了！出现这个提示，立即不断敲击键盘向下按键。只有三秒时间，如果错过了，重复第二步即可。这时候进入菜单选项，选择第4项FIP回车，再输入0回车，输入IP地址:192.168.1.100,工具包打开网络连接，设置本地连接的IP。接着工具包内打开tftpd64.exe文件，选择IP地址:192.168.1.100,回到终端点击回车，输入4.ITB后回车，这时候会自动进入刷写流程，期间路由器和编程器灯光不断闪烁。如图所示代表uboot刷如成功了。

图片[8]-小米AX3000T用TTL编程器救砖教程/超简易版/傻瓜式/支持V1V2版本-勇爱设计Netwrok

图片[9]-小米AX3000T用TTL编程器救砖教程/超简易版/傻瓜式/支持V1V2版本-勇爱设计Netwrok

图片[10]-小米AX3000T用TTL编程器救砖教程/超简易版/傻瓜式/支持V1V2版本-勇爱设计Netwrok

 _             _          _
  __ _    ___  | |_   _ __   (_)   ___  (_)   ___    _ __         ___    ___    _ __ ___
 / _` |  / _ \ | __| | '_ \  | |  / __| | |  / _ \  | '_ \       / __|  / _ \  | '_ ` _ \
| (_| | |  __/ | |_  | |_) | | | | (__  | | | (_) | | | | |  _  | (__  | (_) | | | | | | |
 \__, |  \___|  \__| | .__/  |_|  \___| |_|  \___/  |_| |_| (_)  \___|  \___/  |_| |_| |_|_|
" |___/               |_|"
勇爱设计network出品
更多教程工具尽在getpicion.com
release by getpicion.com
AX3000T救砖TTL工具debrick
请输入串口号input com (如 3):
3
使用串口 COM3

选择波特率Baudrate:
1. 正常normal (921600 / 1500000)
2. 低速 low(115200 / 115200)
2
程序启动后请立刻给路由器插上电源Plug the router in immediately after the program starts
Web Failsafe: http://192.168.1.1/uboot.html

mtk_uartboot - 0.1.1
Using serial port: COM3
Handshake...
hw code: 0x7981
hw sub code: 0x8a00
hw ver: 0xca00
sw ver: 0x1
Baud rate set to 115200
sending payload to 0x201000...
Checksum: 0x55cf
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.10.0   (release):v2.4-rc0-5845-gbacca82a8-dirty
NOTICE:  BL2: Built : 20:18:08, Feb  2 2024
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 115200

进入 U-Boot 后，可以看见类似这样的提示信息。

 *** U-Boot Boot Menu ***

      1. Startup system (Default)
      2. Upgrade firmware
      3. Upgrade ATF BL2
      4. Upgrade ATF FIP
      5. Upgrade single image
      6. Load image
      0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit

*** Upgrading ATF FIP ***

Available load methods:
    0 - TFTP client (Default)
    1 - Xmodem
    2 - Ymodem
    3 - Kermit
    4 - S-Record
    5 - RAM

Select (enter for default): 0

U-Boot's IP address: 192.168.1.1, IP netmask: 255.255.255.0
Input TFTP server's IP address: 192.168.1.100
Input file name: 4.itb

Using ethernet@15100000 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.1
Filename '4.itb'.
Load address: 0x46000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ################################################
         3.2 MiB/s
done
Bytes transferred = 13107200 (c80000 hex)
Saving Environment to MTD... Erasing on MTD device 'nmbm0'... OK
Writing to MTD device 'nmbm0'... OK
OK

*** Loaded 13107200 (0xc80000) bytes at 0x46000000 ***


*** Erase size pasts flash size! ***
Hit any key to stop autoboot:  0

WARNINGS: This Uboot is for mtk_uartboot debrick only! Do not use in normal device!

Web failsafe UI started
URL: http://192.168.1.1/

Press Ctrl+C to exit

第三步：刷入OpenWRT（最后一步，胜利就在眼前）

保持这个终端窗口不动，打开浏览器，输入192.168.1.1就可以进入uboot界面了。选择第一个选项，点击选择文件，选择openwrt固件，点击upadate,稍等片刻就会进入刷机流程。期间路由器灯光闪动。长亮后，新建网页打开192.168.1.1就可以进入openwrt登录界面了。输入账号root登录，密码为空。就可以进入后台了。恭喜路由器救砖成功了。是不是很简易呢？

v2版完整开机流程
GET /
GET /style.css
GET /index.js
GET /version
GET /getmtdlayout
GET /favicon.ico
POST /upload
    Content-Length: 13722835
GET /flashing.html
GET /style.css
GET /index.js
GET /version
GET /result
GET /undefined
ubi0: attaching mtd9
ubi0: scanning is finished
ubi0: attached mtd9 (name "ubi_kernel", size 34 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/0, WL threshold: 4096, image sequence number: 1661892131
ubi0: available PEBs: 75, total reserved PEBs: 197, PEBs reserved for bad PEB handling: 19
Updating volume 'kernel' from 0x460008e8, size 0x573408 ... OK
ubi0: detaching mtd9
ubi0: mtd9 is detached
ubi0: attaching mtd10
ubi0 error: scan_peb: bad image sequence number 844534062 in PEB 272, expected 1661892131
Erase counter header dump:
        magic          0x55424923
        version        1
        ec             2
        vid_hdr_offset 2048
        data_offset    4096
        image_seq      844534062
        hdr_crc        0x6bdc6a0d
erase counter header hexdump:
00000000: 55 42 49 23 01 00 00 00 00 00 00 00 00 00 00 02 00 00 08 00 00 00 10 00 32 56 91 2e 00 00 00 00  UBI#....................2V......
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6b dc 6a 0d  ............................k.j.
ubi0 error: ubi_attach_mtd_dev: failed to attach mtd10, error -22
UBI error: cannot attach mtd10
UBI error: cannot initialize UBI, error -22
*** Failed to attach UBI ***
*** Rebuilding UBI ***
Erasing from 0x0 to 0x4dfffff, size 0x4e00000 ... OK
ubi0: attaching mtd10
ubi0: scanning is finished
ubi0: empty MTD device detected
ubi0: attached mtd10 (name "ubi", size 78 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 624, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 601, total reserved PEBs: 23, PEBs reserved for bad PEB handling: 19
Updating volume 'rootfs' from 0x465740e8, size 0x7a1800 ... OK
ubi0: detaching mtd10
ubi0: mtd10 is detached
resetting ...

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 024B [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):e233a3d581-dirty
NOTICE:  BL2: Built : 06:23:27, Jul 30 2023
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a003f1 000000ff 00100000 00000000
1001d040 | 00027e71 000200a0 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0xc
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 584, worse bit 0, min window 72
Window Sum 576, worse bit 8, min window 72
Window Sum 470, worse bit 1, min window 56
Window Sum 468, worse bit 11, min window 52
Window Sum 474, worse bit 11, min window 52
Window Sum 474, worse bit 1, min window 58
Window Sum 470, worse bit 11, min window 56
Window Sum 482, worse bit 3, min window 58
Window Sum 490, worse bit 14, min window 58
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xef
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
INFO:    Total CPU count: 2
INFO:    MCUSYS: L2C share 256K --> 0K
INFO:    Disable NETSYS SRAM remapping
INFO:    SPMC: Changed to SPMC mode
NOTICE:  BL31: v2.9.0(release):20240123-77-gdff66eeb
NOTICE:  BL31: Built : 20:42:32, Feb  8 2025
INFO:    GICv3 without legacy support detected.
INFO:    ARM GICv3 driver initialized in EL3
INFO:    Maximum SPI INTID supported: 671
INFO:    BL31: Initializing runtime services
INFO:    Secondary bootloader is AArch64
INFO:    BL31: Preparing for EL3 exit to normal world
INFO:    Entry point address = 0x41e00000
INFO:    SPSR = 0x3c9


U-Boot 2022.07 (Feb 08 2025 - 20:42:22 +0800)

CPU:   MediaTek MT7981
Model: mt7981-xiaomi-ax3000t-an8855
DRAM:  256 MiB
Core:  27 devices, 15 uclasses, devicetree: embed

Initializing NMBM ...
spi-nand: spi_nand spi_nand@0: Winbond SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
Could not find a valid device for nmbm0
Signature found at block 1023 [0x07fe0000]
First info table with writecount 0 found in block 960
Second info table with writecount 0 found in block 963
NMBM has been successfully attached

Loading Environment from MTD... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000

  *** U-Boot Boot Menu ***

      1. Startup system (Default)
      2. Upgrade firmware
      3. Upgrade ATF BL2
      4. Upgrade ATF FIP
      5. Upgrade single image
      6. Load image
      0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit
ubi0: attaching mtd9
ubi0: scanning is finished
ubi0: attached mtd9 (name "ubi_kernel", size 34 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 272, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1661892131
ubi0: available PEBs: 52, total reserved PEBs: 220, PEBs reserved for bad PEB handling: 19
Reading from volume 'kernel' to 0x46000000, size 0x0 ... OK
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.6.110
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    5684845 Bytes = 5.4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   0be1ce7f
     Hash algo:    sha1
     Hash value:   bea871ab7bc30c7db8df7cca1fda3b188e99a8af
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt xiaomi_mi-router-ax3000t device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x4656c0a0
     Data Size:    28183 Bytes = 27.5 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   87981bfb
     Hash algo:    sha1
     Hash value:   22a62a37dcdb409d2e732a514bced10a222d0ba0
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x4656c0a0
   Uncompressing Kernel Image
   Loading Device Tree to 000000004f7f1000, end 000000004f7fae16 ... OK

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.6.110 (buildbot@buildbot.infra.immortalwrt.org) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 13.3.0 r33602-e717d133ed6d) 13.3.0, GNU ld (GNU Binutils) 2.42) #0 SMP Mon Oct 27 14:10:17 2025
[    0.000000] Machine model: Xiaomi Mi Router AX3000T
[    0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 KiB) map non-reusable ramoops@42ff0000
[    0.000000] OF: reserved mem: 0x0000000043000000..0x000000004302ffff (192 KiB) nomap non-reusable secmon@43000000
[    0.000000] OF: reserved mem: 0x0000000047c80000..0x0000000047d7ffff (1024 KiB) nomap non-reusable wmcpu-reserved@47c80000
[    0.000000] OF: reserved mem: 0x0000000047d80000..0x0000000047dbffff (256 KiB) nomap non-reusable wo-emi@47d80000
[    0.000000] OF: reserved mem: 0x0000000047dc0000..0x0000000047ffffff (2304 KiB) nomap non-reusable wo-data@47dc0000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x0000000047c7ffff]
[    0.000000]   node   0: [mem 0x0000000047c80000-0x0000000047ffffff]
[    0.000000]   node   0: [mem 0x0000000048000000-0x000000004fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.4
[    0.000000] percpu: Embedded 28 pages/cpu s74984 r8192 d31512 u114688
[    0.000000] pcpu-alloc: s74984 r8192 d31512 u114688 alloc=28*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyS0,115200n1 loglevel=8 swiotlb=512 firmware=0 mtd=ubi uart_en=1
[    0.000000] Unknown kernel command line parameters "firmware=0 mtd=ubi uart_en=1", will be passed to user space.
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 64512
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: area num 2.
[    0.000000] software IO TLB: mapped [mem 0x000000004f900000-0x000000004fa00000] (1MB)
[    0.000000] Memory: 232616K/262144K available (9920K kernel code, 1574K rwdata, 6824K rodata, 512K init, 317K bss, 29528K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv3: GICv3 features: 16 PPIs
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000244] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000253] pid_max: default: 32768 minimum: 301
[    0.003124] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.003131] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.005309] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.005875] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
[    0.006020] rcu: Hierarchical SRCU implementation.
[    0.006023] rcu:     Max phase no-delay instances is 1000.
[    0.006619] smp: Bringing up secondary CPUs ...
[    0.007013] Detected VIPT I-cache on CPU1
[    0.007058] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.007089] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.007160] smp: Brought up 1 node, 2 CPUs
[    0.007166] SMP: Total of 2 processors activated.
[    0.007170] CPU features: detected: 32-bit EL0 Support
[    0.007172] CPU features: detected: CRC32 instructions
[    0.007206] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.007209] CPU: All CPU(s) started at EL2
[    0.007211] alternatives: applying system-wide alternatives
[    0.011496] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.011515] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.012520] pinctrl core: initialized pinctrl subsystem
[    0.013690] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.014077] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.014101] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.014122] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.014541] thermal_sys: Registered thermal governor 'fair_share'
[    0.014546] thermal_sys: Registered thermal governor 'bang_bang'
[    0.014548] thermal_sys: Registered thermal governor 'step_wise'
[    0.014551] thermal_sys: Registered thermal governor 'user_space'
[    0.014640] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[    0.014695] ASID allocator initialised with 65536 entries
[    0.015631] pstore: Using crash dump compression: deflate
[    0.015636] pstore: Registered ramoops as persistent store backend
[    0.015639] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.017410] /soc/interrupt-controller@c000000: Fixed dependency cycle(s) with /soc/interrupt-controller@c000000
[    0.023195] Modules: 27952 pages in range for non-PLT usage
[    0.023203] Modules: 519472 pages in range for PLT usage
[    0.027878] cryptd: max_cpu_qlen set to 1000
[    0.029099] SCSI subsystem initialized
[    0.029323] libata version 3.00 loaded.
[    0.031209] clocksource: Switched to clocksource arch_sys_counter
[    0.033527] NET: Registered PF_INET protocol family
[    0.033632] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.034905] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.034918] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.034928] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.034946] TCP bind hash table entries: 2048 (order: 4, 65536 bytes, linear)
[    0.034996] TCP: Hash tables configured (established 2048 bind 2048)
[    0.035322] MPTCP token hash table entries: 256 (order: 0, 6144 bytes, linear)
[    0.035424] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.035441] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.035637] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.035657] NET: Registered PF_XDP protocol family
[    0.035666] PCI: CLS 0 bytes, default 64
[    0.038344] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.043263] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.043272] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.101132] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.111962] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.115775] printk: console [ttyS0] disabled
[    0.136185] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 72, base_baud = 2500000) is a ST16650V2
[    0.136227] printk: console [ttyS0] enabled
[    0.917035] loop: module loaded
[    0.923335] spi-nand spi0.0: calibration result: 0x3
[    0.928408] spi-nand spi0.0: Winbond SPI NAND was found.
[    0.933757] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 96
[    0.941947] NMBM: mtd OOB size has been overridden to 64B
[    0.947678] Signature found at block 1023 [0x07fe0000]
[    0.952852] NMBM management region starts at block 960 [0x07800000]
[    0.959918] First info table with writecount 0 found in block 960
[    0.968379] Second info table with writecount 0 found in block 963
[    0.974572] NMBM has been successfully attached
[    0.979437] 10 fixed-partitions partitions found on MTD device spi0.0
[    0.985904] Creating 10 MTD partitions on "spi0.0":
[    0.990772] 0x000000000000-0x000000100000 : "BL2"
[    0.996501] 0x000000100000-0x000000140000 : "Nvram"
[    1.002015] 0x000000140000-0x000000180000 : "Bdata"
[    1.007505] 0x000000180000-0x000000380000 : "Factory"
[    1.014361] 0x000000380000-0x000000580000 : "FIP"
[    1.020582] 0x000000580000-0x0000005c0000 : "crash"
[    1.026130] 0x0000005c0000-0x000000600000 : "crash_log"
[    1.032007] 0x000007600000-0x000007640000 : "KF"
[    1.037275] 0x000000600000-0x000002800000 : "ubi_kernel"
[    1.060855] 0x000002800000-0x000007600000 : "ubi"
[    1.741476] an8855-switch: probe of an8855-switch.2.auto failed with error -110
[    1.755422] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc081d80000, irq 75
[    1.765199] i2c_dev: i2c /dev entries driver
[    1.772176] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    1.814859] NET: Registered PF_INET6 protocol family
[    1.820870] Segment Routing with IPv6
[    1.824606] In-situ OAM (IOAM) with IPv6
[    1.828571] NET: Registered PF_PACKET protocol family
[    1.833675] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.846899] 8021q: 802.1Q VLAN Support v1.8
[    1.947690] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[    1.956703] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.967446] mt7530-mdio mdio-bus:1f wan (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=80)
[    1.989650] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=81)
[    2.011701] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=82)
[    2.033791] mt7530-mdio mdio-bus:1f lan4 (uninitialized): PHY [mt7530-0:03] driver [MediaTek MT7531 PHY] (irq=83)
[    2.045380] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode
[    2.052157] DSA: tree 0 setup
[    2.055757] UBI: auto-attach mtd9
[    2.059081] ubi0: default fastmap pool size: 30
[    2.063626] ubi0: default fastmap WL pool size: 15
[    2.068404] ubi0: attaching mtd9
[    2.292704] ubi0: scanning is finished
[    2.300968] ubi0 warning: ubi_eba_init: cannot reserve enough PEBs for bad PEB handling, reserved 17, need 19
[    2.311623] ubi0: attached mtd9 (name "ubi", size 78 MiB)
[    2.317028] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    2.323901] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    2.330675] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    2.337630] ubi0: good PEBs: 624, bad PEBs: 0, corrupted PEBs: 0
[    2.343628] ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
[    2.350835] ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 0
[    2.359173] ubi0: available PEBs: 0, total reserved PEBs: 624, PEBs reserved for bad PEB handling: 17
[    2.368391] ubi0: background thread "ubi_bgt0d" started, PID 659
[    2.369152] block ubiblock0_0: created from ubi0:0(rootfs)
[    2.379892] ubiblock: device ubiblock0_0 (rootfs) set to be root filesystem
[    2.387050] clk: Disabling unused clocks
[    2.395641] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    2.403018] Freeing unused kernel memory: 512K
[    2.407498] Run /sbin/init as init process
[    2.411609]   with arguments:
[    2.414564]     /sbin/init
[    2.417258]   with environment:
[    2.420385]     HOME=/
[    2.422737]     TERM=linux
[    2.425431]     firmware=0
[    2.428125]     mtd=ubi
[    2.430559]     uart_en=1
[    2.605231] init: Console is alive
[    2.608762] init: - watchdog -
[    3.136856] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.193890] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    3.203975] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.217383] init: - preinit -
[    3.497444] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    3.506073] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    3.526927] mt7530-mdio mdio-bus:1f lan4: configuring for phy/gmii link mode
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    5.961219] random: crng init done
[    7.768042] mount_root: loading kmods from internal overlay
[    7.782149] kmodloader: loading kernel modules from //etc/modules-boot.d/*
[    7.789577] kmodloader: done loading kernel modules from //etc/modules-boot.d/*
[    7.870291] block: attempting to load /tmp/overlay/upper/etc/config/fstab
[    7.878507] block: unable to load configuration (fstab: Entry not found)
[    7.885363] block: attempting to load /tmp/overlay/etc/config/fstab
[    7.891853] block: unable to load configuration (fstab: Entry not found)
[    7.898592] block: attempting to load /etc/config/fstab
[    7.905099] block: unable to load configuration (fstab: Entry not found)
[    7.911920] block: no usable configuration
[    7.925991] UBIFS (ubi0:1): default file-system created
[    7.931608] UBIFS (ubi0:1): Mounting in unauthenticated mode
[    7.937360] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 794
[    7.972186] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[    7.980018] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    7.989931] UBIFS (ubi0:1): FS size: 66916352 bytes (63 MiB, 527 LEBs), max 537 LEBs, journal size 3301376 bytes (3 MiB, 26 LEBs)
[    8.001583] UBIFS (ubi0:1): reserved for root: 3160624 bytes (3086 KiB)
[    8.008184] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 7B9FB7D5-B5BE-4A16-A61C-0CB4AE4F7624, small LPT model
[    8.020091] block: attempting to load /tmp/ubifs_cfg/upper/etc/config/fstab
[    8.027255] block: unable to load configuration (fstab: Entry not found)
[    8.034028] block: attempting to load /tmp/ubifs_cfg/etc/config/fstab
[    8.040534] block: unable to load configuration (fstab: Entry not found)
[    8.047283] block: attempting to load /etc/config/fstab
[    8.052576] block: unable to load configuration (fstab: Entry not found)
[    8.059302] block: no usable configuration
[    8.066126] UBIFS (ubi0:1): un-mount UBI device 0
[    8.070842] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" stops
[    8.079946] UBIFS (ubi0:1): Mounting in unauthenticated mode
[    8.085725] UBIFS (ubi0:1): background thread "ubifs_bgt0_1" started, PID 797
[    8.127685] UBIFS (ubi0:1): UBIFS: mounted UBI device 0, volume 1, name "rootfs_data"
[    8.135545] UBIFS (ubi0:1): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    8.145460] UBIFS (ubi0:1): FS size: 66916352 bytes (63 MiB, 527 LEBs), max 537 LEBs, journal size 3301376 bytes (3 MiB, 26 LEBs)
[    8.157105] UBIFS (ubi0:1): reserved for root: 3160624 bytes (3086 KiB)
[    8.163712] UBIFS (ubi0:1): media format: w5/r0 (latest is w5/r0), UUID 7B9FB7D5-B5BE-4A16-A61C-0CB4AE4F7624, small LPT model
[    8.201398] block: attempting to load /tmp/overlay/upper/etc/config/fstab
[    8.208278] block: unable to load configuration (fstab: Entry not found)
[    8.215182] block: attempting to load /tmp/overlay/etc/config/fstab
[    8.221615] block: unable to load configuration (fstab: Entry not found)
[    8.228351] block: attempting to load /etc/config/fstab
[    8.233646] block: unable to load configuration (fstab: Entry not found)
[    8.240372] block: no usable configuration
[    8.246040] block: attempting to load /tmp/ubifs_cfg/upper/etc/config/fstab
[    8.253143] block: unable to load configuration (fstab: Entry not found)
[    8.259878] block: attempting to load /tmp/ubifs_cfg/etc/config/fstab
[    8.266391] block: unable to load configuration (fstab: Entry not found)
[    8.273136] block: attempting to load /etc/config/fstab
[    8.278420] block: unable to load configuration (fstab: Entry not found)
[    8.285162] block: no usable configuration
[    8.290530] mount_root: overlay filesystem has not been fully initialized yet
[    8.298022] mount_root: switching to ubifs overlay
[    8.308136] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
[    8.321968] urandom-seed: Seed file not found (/etc/urandom.seed)
[    8.350407] procd: - early -
[    8.353468] procd: - watchdog -
[    8.905219] procd: - watchdog -
[    8.954861] procd: - ubus -
[    9.023735] procd: - init -
Please press Enter to activate this console.
[    9.367042] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.437894] NET: Registered PF_ALG protocol family
[    9.448069] GACT probability on
[    9.452987] Mirror/redirect action on
[    9.464506] u32 classifier
[    9.467216]     input device check on
[    9.470864]     Actions configured
[    9.485295] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[    9.513317] Loading modules backported from Linux version v6.12.52-0-g2b2cbdcede38
[    9.520883] Backport generated by backports.git v6.1.110-1-35-g410656ef
[    9.582338] urngd: v1.0.2 started.
[    9.748249] mt798x-wmac 18000000.wifi: attaching wed device 0 version 2
[    9.799647] platform 15010000.wed: MTK WED WO Firmware Version: DEV_000000, Build Time: 20221208202138
[    9.808991] platform 15010000.wed: MTK WED WO Chip ID 00 Region 3
[   10.361726] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20240823161240a
[   10.361726]
[   10.555765] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20240823161304
[   10.650043] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20240823161841
[   10.747525] mt798x-wmac 18000000.wifi: registering led 'mt76-phy0'
[   10.793239] mt798x-wmac 18000000.wifi: registering led 'mt76-phy1'
[   10.881805] PPP generic driver version 2.4.2
[   10.887021] PPP MPPE Compression module registered
[   10.893187] NET: Registered PF_PPPOX protocol family
[   10.902287] kmodloader: done loading kernel modules from /etc/modules.d/*
[   12.105883] mtdblock: MTD device 'Bdata' is NAND, please consider using UBI block devices instead.
[   14.514739] bridger[1886]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
[   21.502517] mtk_soc_eth 15100000.ethernet eth0: Link is Down
[   21.517622] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[   21.526727] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[   21.546438] mt7530-mdio mdio-bus:1f lan2: configuring for phy/gmii link mode
[   21.556771] br-lan: port 1(lan2) entered blocking state
[   21.562081] br-lan: port 1(lan2) entered disabled state
[   21.567343] mt7530-mdio mdio-bus:1f lan2: entered allmulticast mode
[   21.573651] mtk_soc_eth 15100000.ethernet eth0: entered allmulticast mode
[   21.584187] mt7530-mdio mdio-bus:1f lan2: entered promiscuous mode
[   21.609227] mt7530-mdio mdio-bus:1f lan3: configuring for phy/gmii link mode
[   21.621649] br-lan: port 2(lan3) entered blocking state
[   21.626884] br-lan: port 2(lan3) entered disabled state
[   21.632198] mt7530-mdio mdio-bus:1f lan3: entered allmulticast mode
[   21.642755] mt7530-mdio mdio-bus:1f lan3: entered promiscuous mode
[   21.659981] mt7530-mdio mdio-bus:1f lan4: configuring for phy/gmii link mode
[   21.672891] br-lan: port 3(lan4) entered blocking state
[   21.678128] br-lan: port 3(lan4) entered disabled state
[   21.683487] mt7530-mdio mdio-bus:1f lan4: entered allmulticast mode
[   21.693175] mt7530-mdio mdio-bus:1f lan4: entered promiscuous mode
[   21.718451] mt7530-mdio mdio-bus:1f wan: configuring for phy/gmii link mode
[   23.908290] br-lan: port 4(phy0-ap0) entered blocking state
[   23.913928] br-lan: port 4(phy0-ap0) entered disabled state
[   23.919533] mt798x-wmac 18000000.wifi phy0-ap0: entered allmulticast mode
[   23.926536] mt798x-wmac 18000000.wifi phy0-ap0: entered promiscuous mode
[   24.086637] br-lan: port 4(phy0-ap0) entered blocking state
[   24.092234] br-lan: port 4(phy0-ap0) entered forwarding state
[   24.247181] br-lan: port 5(phy1-ap0) entered blocking state
[   24.252818] br-lan: port 5(phy1-ap0) entered disabled state
[   24.258430] mt798x-wmac 18000000.wifi phy1-ap0: entered allmulticast mode
[   24.265458] mt798x-wmac 18000000.wifi phy1-ap0: entered promiscuous mode
[   24.272378] br-lan: port 5(phy1-ap0) entered blocking state
[   24.277948] br-lan: port 5(phy1-ap0) entered forwarding state
[   24.926824] mt7530-mdio mdio-bus:1f lan2: Link is Up - 1Gbps/Full - flow control off
[   24.934626] br-lan: port 5(phy1-ap0) entered disabled state
[   24.940317] br-lan: port 1(lan2) entered blocking state
[   24.945562] br-lan: port 1(lan2) entered forwarding state
[   24.982233] br-lan: port 5(phy1-ap0) entered blocking state
[   24.987817] br-lan: port 5(phy1-ap0) entered forwarding state

有网友出现以下错误

 _             _          _
  __ _    ___  | |_   _ __   (_)   ___  (_)   ___    _ __         ___    ___    _ __ ___
 / _` |  / _ \ | __| | '_ \  | |  / __| | |  / _ \  | '_ \       / __|  / _ \  | '_ ` _ \
| (_| | |  __/ | |_  | |_) | | | | (__  | | | (_) | | | | |  _  | (__  | (_) | | | | | | |
 \__, |  \___|  \__| | .__/  |_|  \___| |_|  \___/  |_| |_| (_)  \___|  \___/  |_| |_| |_|_|
" |___/               |_|"
勇爱设计network出品
更多教程工具尽在getpicion.com
release by getpicion.com
AX3000T救砖TTL工具debrick
请输入串口号input com (如 3):
3
使用串口 COM3

选择波特率Baudrate:
1. 正常normal (921600 / 1500000)
2. 低速 low(115200 / 115200)
2
程序启动后请立刻给路由器插上电源Plug the router in immediately after the program starts
Web Failsafe: http://192.168.1.1/uboot.html

mtk_uartboot - 0.1.1
Using serial port: COM3
Handshake...
thread 'main' panicked at src\bootrom.rs:45:53:
called `Result::unwrap()` on an `Err` value: Custom { kind: TimedOut, error: "Operation timed out" }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

大概率原因：线插错了！仔细看图重新插线！

文章版权归作者所有，未经允许请勿转载。

THE END