中国移动CMCC MR3000D-CIq (256M/512M)路由器TTL救砖刷机教程

🛠️ 必备工具

1. USB-TTL 编程器（ttl淘宝链接https://item.taobao.com/item.htm?id=607822831459&spm=a21m98.27004841杜邦线排针要一公一母，不是我开的店，可以自行购买
2. 螺丝刀/刀片/磁卡
3. 一台电脑（Windows10/11）
4. 傻瓜式工具+恢复工具
5. 设备对应的 U-Boot 恢复镜像 / 固件文件

第一步、连接TTL编程器

1.编程器使用3.3v连接。接口上的TX插路由的RX，RX插TX，GND插GND，VCC不需要插。教程使用的是杜邦线排针针夹，不需要焊接。如图所示就代表连接好了。需要拆机教程可看简介专门图文链接。恭喜本教程最难的一步已经完成，接下来可以傻瓜式操作了。

#openwrt启动信息
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0252 [010F]
Jump to BL

NOTICE:  BL2: v2.6(release):04446c1-dirty
NOTICE:  BL2: Built : 07:40:56, Jan  4 2023
NOTICE:  WDT: disabled
NOTICE:  EMI: Using DDR3 settings

dump toprgu registers data:
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data:
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0
BYTE_swap:0
Window Sum 628, worse bit 5, min window 76
Window Sum 620, worse bit 8, min window 76
Window Sum 576, worse bit 0, min window 70
Window Sum 554, worse bit 15, min window 66
Window Sum 580, worse bit 1, min window 70
Window Sum 558, worse bit 9, min window 68
Window Sum 562, worse bit 9, min window 68
Window Sum 572, worse bit 8, min window 70
NOTICE:  EMI: Detected DRAM size: 256MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  CPU: MT7981 (1300MHz)
NOTICE:  SPI_NAND parses attributes from parameter page.
NOTICE:  SPI_NAND Detected ID 0xcd
NOTICE:  Page size 2048, Block size 131072, size 134217728
NOTICE:  Initializing NMBM ...
NOTICE:  Signature found at block 1023 [0x07fe0000]
NOTICE:  First info table with writecount 0 found in block 960
NOTICE:  Second info table with writecount 0 found in block 963
NOTICE:  NMBM has been successfully attached in read-only mode
NOTICE:  BL2: Booting BL31
INFO:    Total CPU count: 2
INFO:    MCUSYS: L2C share 256K --> 0K
INFO:    Disable NETSYS SRAM remapping
INFO:    SPMC: Changed to SPMC mode
NOTICE:  BL31: v2.12.0(release):b13fb902
NOTICE:  BL31: Built : 00:33:27, Feb 22 2025
INFO:    GICv3 without legacy support detected.
INFO:    ARM GICv3 driver initialized in EL3
INFO:    Maximum SPI INTID supported: 671
INFO:    [DEVAPC] devapc_init done
INFO:    [MPU](Region0)sa:0x0300, ea:0x0301
INFO:    [MPU](Region0)apc0:0x80b6db69, apc1:0x00b6db6d
INFO:    [MPU](Region1)sa:0x0000, ea:0x0000
INFO:    [MPU](Region1)apc0:0x00000000, apc1:0x00000000
INFO:    [MPU](Region2)sa:0x0000, ea:0x0000
INFO:    [MPU](Region2)apc0:0x00000000, apc1:0x00000000
INFO:    [MPU](Region3)sa:0x0000, ea:0x0000
INFO:    [MPU](Region3)apc0:0x00000000, apc1:0x00000000
INFO:    BL31: Initializing runtime services
INFO:    Secondary bootloader is AArch64
INFO:    BL31: Preparing for EL3 exit to normal world
INFO:    Entry point address = 0x41e00000
INFO:    SPSR = 0x3c9


U-Boot 2023.07 (Feb 22 2025 - 00:33:03 +0800)

CPU:   MediaTek MT7981
Model: mt7981-newland_nl-wr8103
       (mediatek,mt7981-rfb)
DRAM:  256 MiB
Core:  29 devices, 14 uclasses, devicetree: embed

Initializing NMBM ...
spi-nand: spi_nand spi_nand@0: foresee SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
Could not find a valid device for nmbm0
Signature found at block 1023 [0x07fe0000]
First info table with writecount 0 found in block 960
Second info table with writecount 0 found in block 963
NMBM has been successfully attached

Loading Environment from MTD... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   eth0: ethernet@15100000

  *** U-Boot Boot Menu ***

      1. Startup system (Default)
      2. Upgrade firmware
      3. Upgrade ATF BL2
      4. Upgrade ATF FIP
      5. Upgrade single image
      6. Load image
      7. Start Web failsafe
      0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC to quit
ubi0: attaching mtd6
ubi0: scanning is finished
ubi0: attached mtd6 (name "ubi", size 48 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 384, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1784102193
ubi0: available PEBs: 0, total reserved PEBs: 384, PEBs reserved for bad PEB handling: 19
No size specified -> Using max size (4825088)
Read 4825088 bytes from volume kernel to 0000000046000000
## Loading kernel from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.12.94
     Type:         Kernel Image
     Compression:  lzma compressed
     Data Start:   0x460000e8
     Data Size:    4727779 Bytes = 4.5 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x48000000
     Entry Point:  0x48000000
     Hash algo:    crc32
     Hash value:   1089e0e2
     Hash algo:    sha1
     Hash value:   6222aafb0503834b1f225117b514326baf57e5d2
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
   Using 'config-1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt cmcc_mr3000d-ciq-256m device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x46482614
     Data Size:    22681 Bytes = 22.1 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   976a7098
     Hash algo:    sha1
     Hash value:   eb5cbacb5086071e0bf0193a5e4d6e8bb44e809c
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x46482614
Working FDT set to 46482614
   Uncompressing Kernel Image
   Loading Device Tree to 000000004f7f2000, end 000000004f7fa898 ... OK
Working FDT set to 4f7f2000

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[    0.000000] Linux version 6.12.94 (runner@runnervm5mmn9) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r33051-f5dae5ece4) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Wed Jul 15 07:56:33 2026
[    0.000000] Machine model: CMCC MR3000D-CIq (256M)
[    0.000000] OF: reserved mem: 0x0000000042ff0000..0x0000000042ffffff (64 KiB) map non-reusable ramoops@42ff0000
[    0.000000] OF: reserved mem: 0x0000000043000000..0x000000004302ffff (192 KiB) nomap non-reusable secmon@43000000
[    0.000000] OF: reserved mem: 0x0000000047c80000..0x0000000047d7ffff (1024 KiB) nomap non-reusable wmcpu-reserved@47c80000
[    0.000000] OF: reserved mem: 0x0000000047d80000..0x0000000047dbffff (256 KiB) nomap non-reusable wo-emi@47d80000
[    0.000000] OF: reserved mem: 0x0000000047dc0000..0x0000000047ffffff (2304 KiB) nomap non-reusable wo-data@47dc0000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000042ffffff]
[    0.000000]   node   0: [mem 0x0000000043000000-0x000000004302ffff]
[    0.000000]   node   0: [mem 0x0000000043030000-0x0000000047c7ffff]
[    0.000000]   node   0: [mem 0x0000000047c80000-0x0000000047ffffff]
[    0.000000]   node   0: [mem 0x0000000048000000-0x000000004fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000004fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.1 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.5
[    0.000000] percpu: Embedded 21 pages/cpu s45784 r8192 d32040 u86016
[    0.000000] pcpu-alloc: s45784 r8192 d32040 u86016 alloc=21*4096
[    0.000000] pcpu-alloc: [0] 0 [0] 1
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: GIC system register CPU interface
[    0.000000] CPU features: kernel page table isolation disabled by kernel configuration
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line:
[    0.000000] Dentry cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 5, 131072 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 65536
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: SWIOTLB bounce buffer size adjusted to 0MB
[    0.000000] software IO TLB: area num 2.
[    0.000000] software IO TLB: SWIOTLB bounce buffer size roundup to 0MB
[    0.000000] software IO TLB: mapped [mem 0x000000004fe49000-0x000000004fec9000] (0MB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu:     RCU restricting CPUs from NR_CPUS=4 to nr_cpu_ids=2.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[    0.000000] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=2.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
[    0.000000] GICv3: 640 SPIs implemented
[    0.000000] GICv3: 0 Extended SPIs implemented
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv3: GICv3 features: 16 PPIs
[    0.000000] GICv3: GICD_CTRL.DS=0, SCR_EL3.FIQ=0
[    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x000000000c080000
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 timer(s) running at 13.00MHz (phys).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x2ff89eacb, max_idle_ns: 440795202429 ns
[    0.000000] sched_clock: 56 bits at 13MHz, resolution 76ns, wraps every 4398046511101ns
[    0.000213] Calibrating delay loop (skipped), value calculated using timer frequency.. 26.00 BogoMIPS (lpj=130000)
[    0.000222] pid_max: default: 32768 minimum: 301
[    0.003142] Mount-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.003150] Mountpoint-cache hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.005330] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    0.006159] rcu: Hierarchical SRCU implementation.
[    0.006166] rcu:     Max phase no-delay instances is 1000.
[    0.006370] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[    0.006597] smp: Bringing up secondary CPUs ...
[    0.006991] Detected VIPT I-cache on CPU1
[    0.007038] GICv3: CPU1: found redistributor 1 region 0:0x000000000c0a0000
[    0.007068] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
[    0.007153] smp: Brought up 1 node, 2 CPUs
[    0.007158] SMP: Total of 2 processors activated.
[    0.007161] CPU: All CPU(s) started at EL2
[    0.007163] CPU features: detected: 32-bit EL0 Support
[    0.007166] CPU features: detected: CRC32 instructions
[    0.007189] alternatives: applying system-wide alternatives
[    0.007320] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.007448] Memory: 236000K/262144K available (9792K kernel code, 1020K rwdata, 2884K rodata, 512K init, 318K bss, 24436K reserved, 0K cma-reserved)
[    0.010550] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.010567] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
[    0.010626] 29088 pages in range for non-PLT usage
[    0.010629] 520608 pages in range for PLT usage
[    0.012118] pinctrl core: initialized pinctrl subsystem
[    0.014535] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.014850] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.014875] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.014896] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.015301] thermal_sys: Registered thermal governor 'fair_share'
[    0.015304] thermal_sys: Registered thermal governor 'bang_bang'
[    0.015307] thermal_sys: Registered thermal governor 'step_wise'
[    0.015310] thermal_sys: Registered thermal governor 'user_space'
[    0.015359] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
[    0.015415] ASID allocator initialised with 65536 entries
[    0.016245] ramoops: found existing invalid buffer, size 2097152, start 680012032
[    0.016348] pstore: Using crash dump compression: deflate
[    0.016352] pstore: Registered ramoops as persistent store backend
[    0.016354] ramoops: using 0x10000@0x42ff0000, ecc: 0
[    0.017849] /soc/interrupt-controller@c000000: Fixed dependency cycle(s) with /soc/interrupt-controller@c000000
[    0.029042] HugeTLB: registered 1.00 GiB page size, pre-allocated 0 pages
[    0.029051] HugeTLB: 0 KiB vmemmap can be freed for a 1.00 GiB page
[    0.029055] HugeTLB: registered 32.0 MiB page size, pre-allocated 0 pages
[    0.029058] HugeTLB: 0 KiB vmemmap can be freed for a 32.0 MiB page
[    0.029062] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
[    0.029065] HugeTLB: 0 KiB vmemmap can be freed for a 2.00 MiB page
[    0.029068] HugeTLB: registered 64.0 KiB page size, pre-allocated 0 pages
[    0.029071] HugeTLB: 0 KiB vmemmap can be freed for a 64.0 KiB page
[    0.035167] cryptd: max_cpu_qlen set to 1000
[    0.036575] SCSI subsystem initialized
[    0.036751] libata version 3.00 loaded.
[    0.038538] clocksource: Switched to clocksource arch_sys_counter
[    0.040935] NET: Registered PF_INET protocol family
[    0.041032] IP idents hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.042311] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.042327] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.042339] TCP established hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.042358] TCP bind hash table entries: 2048 (order: 4, 65536 bytes, linear)
[    0.042409] TCP: Hash tables configured (established 2048 bind 2048)
[    0.042605] MPTCP token hash table entries: 256 (order: 1, 6144 bytes, linear)
[    0.042708] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.042724] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.042929] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.042954] PCI: CLS 0 bytes, default 64
[    0.044336] workingset: timestamp_bits=46 max_order=16 bucket_order=0
[    0.049022] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.049031] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.104995] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.115955] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.119650] printk: legacy console [ttyS0] disabled
[    0.140069] 11002000.serial: ttyS0 at MMIO 0x11002000 (irq = 72, base_baud = 2500000) is a ST16650V2
[    0.140114] printk: legacy console [ttyS0] enabled
[    0.977987] random: crng init done
[    0.984402] loop: module loaded
[    0.990446] spi-nand spi0.0: calibration result: 0x3
[    0.995516] spi-nand spi0.0: FORESEE SPI NAND was found.
[    1.000853] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[    1.009558] Signature found at block 1023 [0x07fe0000]
[    1.014699] NMBM management region starts at block 960 [0x07800000]
[    1.021800] First info table with writecount 0 found in block 960
[    1.030269] Second info table with writecount 0 found in block 963
[    1.036442] NMBM has been successfully attached
[    1.041193] 8 fixed-partitions partitions found on MTD device spi0.0
[    1.047797] Creating 8 MTD partitions on "spi0.0":
[    1.052612] 0x000000000000-0x000000100000 : "BL2"
[    1.058367] 0x000000100000-0x000000180000 : "u-boot-env"
[    1.064388] 0x000000180000-0x000000380000 : "Factory"
[    1.071113] 0x000000380000-0x000000580000 : "FIP"
[    1.077234] 0x000000580000-0x000003580000 : "ubi"
[    1.105504] ubi0: default fastmap pool size: 15
[    1.110062] ubi0: default fastmap WL pool size: 7
[    1.114757] ubi0: attaching mtd4
[    1.289825] ubi0: scanning is finished
[    1.297766] ubi0 warning: ubi_eba_init: cannot reserve enough PEBs for bad PEB handling, reserved 17, need 19
[    1.308156] ubi0: attached mtd4 (name "ubi", size 48 MiB)
[    1.313582] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    1.320456] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    1.327232] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    1.334186] ubi0: good PEBs: 384, bad PEBs: 0, corrupted PEBs: 0
[    1.340187] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[    1.347395] ubi0: max/mean erase counter: 2/0, WL threshold: 4096, image sequence number: 1784102193
[    1.356516] ubi0: available PEBs: 0, total reserved PEBs: 384, PEBs reserved for bad PEB handling: 17
[    1.365732] ubi0: background thread "ubi_bgt0d" started, PID 267
[    1.366455] block ubiblock0_1: created from ubi0:1(rootfs)
[    1.377229] ubiblock: device ubiblock0_1 (rootfs) set to be root filesystem
[    1.384307] 0x000003580000-0x000006580000 : "ubi1"
[    1.411762] 0x000006580000-0x0000065a0000 : "Product"
[    1.417265] 0x0000065a0000-0x0000075a0000 : "Custom"
[    1.567649] mtk_soc_eth 15100000.ethernet eth0: mediatek frame engine at 0xffffffc081a80000, irq 75
[    1.577549] mtk_soc_eth 15100000.ethernet eth1: mediatek frame engine at 0xffffffc081a80000, irq 75
[    1.587383] i2c_dev: i2c /dev entries driver
[    1.593399] mtk-wdt 1001c000.watchdog: Watchdog enabled (timeout=31 sec, nowayout=0)
[    1.602576] NET: Registered PF_INET6 protocol family
[    1.608363] Segment Routing with IPv6
[    1.612081] In-situ OAM (IOAM) with IPv6
[    1.616041] NET: Registered PF_PACKET protocol family
[    1.621155] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.634516] 8021q: 802.1Q VLAN Support v1.8
[    1.713900] mt7530-mdio mdio-bus:1f: configuring for fixed/2500base-x link mode
[    1.722961] mt7530-mdio mdio-bus:1f: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    1.732691] mt7530-mdio mdio-bus:1f lan1 (uninitialized): PHY [mt7530-0:00] driver [MediaTek MT7531 PHY] (irq=79)
[    1.753881] mt7530-mdio mdio-bus:1f lan2 (uninitialized): PHY [mt7530-0:01] driver [MediaTek MT7531 PHY] (irq=80)
[    1.774883] mt7530-mdio mdio-bus:1f lan3 (uninitialized): PHY [mt7530-0:02] driver [MediaTek MT7531 PHY] (irq=81)
[    1.786638] mtk_soc_eth 15100000.ethernet eth0: entered promiscuous mode
[    1.793396] DSA: tree 0 setup
[    1.796670] clk: Disabling unused clocks
[    1.800889] PM: genpd: Disabling unused power domains
[    1.810502] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    1.817858] Freeing unused kernel memory: 512K
[    1.822422] Run /sbin/init as init process
[    1.826510]   with arguments:
[    1.829484]     /sbin/init
[    1.832180]   with environment:
[    1.835308]     HOME=/
[    1.837655]     TERM=linux
[    2.107450] init: Console is alive
[    2.111048] init: - watchdog -
[    2.582057] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.613702] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    2.624105] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.639172] init: - preinit -
[    3.189427] mtk_soc_eth 15100000.ethernet eth0: configuring for fixed/2500base-x link mode
[    3.197893] mtk_soc_eth 15100000.ethernet eth0: Link is Up - 2.5Gbps/Full - flow control rx/tx
[    3.232846] mt7530-mdio mdio-bus:1f lan1: configuring for phy/gmii link mode
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    7.446630] mount_root: loading kmods from internal overlay
[    7.461725] kmodloader: loading kernel modules from //etc/modules-boot.d/*
[    7.471080] kmodloader: done loading kernel modules from //etc/modules-boot.d/*
[    7.581884] block: attempting to load /tmp/overlay/upper/etc/config/fstab
[    7.590119] block: unable to load configuration (fstab: Entry not found)
[    7.596895] block: attempting to load /tmp/overlay/etc/config/fstab
[    7.603307] block: unable to load configuration (fstab: Entry not found)
[    7.610056] block: attempting to load /etc/config/fstab
[    7.618078] block: unable to load configuration (fstab: Entry not found)
[    7.624893] block: no usable configuration
[    7.631523] UBIFS (ubi0:2): Mounting in unauthenticated mode
[    7.637272] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 756
[    7.658765] UBIFS (ubi0:2): recovery needed
[    7.732983] UBIFS (ubi0:2): recovery completed
[    7.737504] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[    7.745341] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    7.755253] UBIFS (ubi0:2): FS size: 4190208 bytes (3 MiB, 33 LEBs), max 43 LEBs, journal size 1015809 bytes (0 MiB, 6 LEBs)
[    7.766464] UBIFS (ubi0:2): reserved for root: 197913 bytes (193 KiB)
[    7.772899] UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID 0FD252D6-4181-4DF5-9841-97DA3E06B7F6, small LPT model
[    7.785296] block: attempting to load /tmp/ubifs_cfg/upper/etc/config/fstab
[    7.796197] block: extroot: not configured
[    7.800452] UBIFS (ubi0:2): un-mount UBI device 0
[    7.805161] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" stops
[    7.814483] UBIFS (ubi0:2): Mounting in unauthenticated mode
[    7.820261] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 759
[    7.867403] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[    7.875280] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[    7.885185] UBIFS (ubi0:2): FS size: 4190208 bytes (3 MiB, 33 LEBs), max 43 LEBs, journal size 1015809 bytes (0 MiB, 6 LEBs)
[    7.896392] UBIFS (ubi0:2): reserved for root: 197913 bytes (193 KiB)
[    7.902824] UBIFS (ubi0:2): media format: w5/r0 (latest is w5/r0), UUID 0FD252D6-4181-4DF5-9841-97DA3E06B7F6, small LPT model
[    7.916652] mount_root: loading kmods from internal overlay
[    7.931267] kmodloader: loading kernel modules from /tmp/overlay/upper/etc/modules-boot.d/*
[    7.940858] kmodloader: done loading kernel modules from /tmp/overlay/upper/etc/modules-boot.d/*
[    7.994117] block: attempting to load /tmp/overlay/upper/etc/config/fstab
[    8.003648] block: extroot: not configured
[    8.009489] block: attempting to load /tmp/ubifs_cfg/upper/etc/config/fstab
[    8.016682] block: extroot: not configured
[    8.022586] mount_root: switching to ubifs overlay
[    8.032396] overlayfs: null uuid detected in lower fs '/', falling back to xino=off,index=off,nfs_export=off.
[    8.045712] urandom-seed: Seeding with /etc/urandom.seed
[    8.103258] procd: - early -
[    8.106205] procd: - watchdog -
[    8.665657] procd: - watchdog -
[    8.669018] procd: - ubus -
[    8.825096] procd: - init -
Please press Enter to activate this console.
[    9.747154] urngd: v1.0.2 started.
[   10.460371] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.526265] NET: Registered PF_ALG protocol family
[   10.541821] zram: Added device: zram0
[   10.560712] tun: Universal TUN/TAP device driver, 1.6
[   10.616961] crypto-safexcel 10320000.crypto: EIP97:230(0,1,4,4)-HIA:270(0,5,5),PE:150/433(alg:7fcdfc00)/0/0/0
[   10.642401] Loading modules backported from Linux version v6.18.26-0-g1fe060681
[   10.649785] Backport generated by backports.git 6ecbb44
[   10.715545] xt_time: kernel timezone is -0000
[   11.189681] mt798x-wmac 18000000.wifi: HW/SW Version: 0x8a108a10, Build Time: 20240823161240a
[   11.387320] mt798x-wmac 18000000.wifi: WM Firmware Version: ____000000, Build Time: 20240823161304
[   11.769474] mt798x-wmac 18000000.wifi: WA Firmware Version: DEV_000000, Build Time: 20240823161841
[   11.866847] mt798x-wmac 18000000.wifi: registering led 'mt76-phy0'
[   11.912521] mt798x-wmac 18000000.wifi: registering led 'mt76-phy1'
[   12.014276] PPP generic driver version 2.4.2
[   12.020830] PPP MPPE Compression module registered
[   12.026909] NET: Registered PF_PPPOX protocol family
[   12.035001] kmodloader: done loading kernel modules from /etc/modules.d/*

Kwrt login:

第二步、刷入引导文件

路由器变砖有很多原因。非硬件类故障，教程可救砖修复。编程器和LAN口1，2，3口连接电脑。路由器断电状态。运行连通性测试.bat。点击打开设备管理器，查看电脑的USB的COM口。例如演示的这台电脑显示是3。输入3回车后再次回车。给路由器插上通电。正常情况就会开始跑动数据。

如果无任何显示原因：电脑USB接触不良，TTL接触不良或者错误，硬件损坏等，断电依据原因重新尝试。关闭测试窗口。路由器重新断电。运行救砖.bat。输入3回车，输入2回车，给路由器重新插电。正常情况就会开始进入自动化流程。过程大概2分钟。关键来了！出现这个提示，立即不断敲击键盘向下按键。只有三秒时间，如果错过了，键盘按住ctrl+c进入终端命令。输入bootmenu命令进入菜单。

选择4回车。设置本地IP地址为192.168.1.254等。打开运行TFTP工具。完成后重新回到终端。输入ip地址192.168.1.254回车，复制命令回车。完成后再次输入bootmenu命令回菜单。选择二回车，输入0回车。输入ip地址192.168.1.254回车，复制命令回车。无报错后输入reset重启。这里看到启动失败报错。没有关系。断电按住reset不松手。直到灯光闪动常亮后再松手。浏览器打开192.168.1.1进入uboot刷入openwrt固件就可以完成救砖了。路由器重启完成后。IP地址改成自动获取。浏览器打开10.0.0.1。就可以登陆openwrt了。

好了，CMCC MR3000d-CIQ的完整救砖流程就到这了。稍微一点点繁琐，但是按步骤来绝对不会错。有任何问题欢迎留言。觉得有用的，别忘了关注点赞收藏，咱们下期见！