"System halt!" message at the booting of MT3000

Technical Support for Routers
1

Hallo,

Unfortunately my router MT3000 is fully bricked after upgrading the firmware, I only have the following output when I connected the serial:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
F5: 480A 0031
00: 1005 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 3903 0041
F3: 1001 0000 [0200]
F3: 1001 0000
F6: 102C 0000
01: 102A 0001
02: 1005 0000
BP: 2000 00C0 [0001]
EC: 0000 0000 [1000]
T0: 0000 00ED [010F]
System halt!

I tried all what I can do, but in vain, it seems that I have to compile U-Boot and manually load it into the flash. I am willing to do so, but I need U-Boot source code as the link to GL.iNet mt798x Github repo. is broken.

EDIT (1):
There is no U-Boot nor anything on this flash at the moment.

Can someone help me out here with all the steps required to install U-Boot and firmware from scratch on an empty flash of MT3000?

Thank you in advance.

2

I was able to find a sub repo cloned the same files from the repo of GL.iNet for mt798x [link is here] , and I was able to compile U-Boot. I tried to transfer the U-Boot image to address 0x00 on the chip by using CH341 Programmer but nothing happened and I still get the same “System halt!” message and there is no boot loader.

Also I cannot find a JTAG on the router board so I cannot use JTAG programmer either.

3

I’d hold tight for a GL rep to see this thread; I’ve seen past threads where they’ve assisted in device recovery that seem to be just as difficult as this one. You might end up needing to converse over email.

@yuxin.zou or @hansome will probably be the first to respond.

4

I only need how to put U-Boot to the flash,

I read other posts here and here, but I need to know first how to fix U-Boot alone, because I also do not have any backup of the flash contents, so at least I need to get U-Boot working, then the rest will come next indeed one by one.

5

Pls try to flash gl-mt3000-nand-single.bin to address 0x00 on the chip;
mt3000.zip (377.1 KB)

note: you should back up the factory partition by using CH341 Programmer before doing that

Factory partition address is 0x180000 ~ 0x37ffff
image

6

Thank you very much @dengxinfa

I tried to upload the U-Boot file you gave in your post, I can see difference at booting log, but the router still does not boot.

Here is the log of booting:


F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0244 [010F]
Jump to BL


dump toprgu registers data: 
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data: 
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8 
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0 
BYTE_swap:0 
[TxChooseVref] Worse bit 0, Min win 0, Win sum 0, Final Vref 0

I am willing also to compile the U-Boot from the source, but How can I do that? also where is that source where I can compile from?

Once again, Thank you!

7

I also do not have the source code, I read mtd1~mtd4 through the Programmer to form gl-mt3000-nand-single.bin file.

I have tested that by writing GL-MT3000-nand-singlet.bin to a flash without any data through the Programmer, uboot can run normally.

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0244 [010F]
Jump to BL


dump toprgu registers data: 
1001c000 | 00000000 0000ffe0 00000000 00000000
1001c010 | 00000fff 00000000 00f00000 00000000
1001c020 | 00000000 00000000 00000000 00000000
1001c030 | 003c0003 003c0003 00000000 00000000
1001c040 | 00000000 00000000 00000000 00000000
1001c050 | 00000000 00000000 00000000 00000000
1001c060 | 00000000 00000000 00000000 00000000
1001c070 | 00000000 00000000 00000000 00000000
1001c080 | 00000000 00000000 00000000 00000000

dump drm registers data: 
1001d000 | 00000000 00000000 00000000 00000000
1001d010 | 00000000 00000000 00000000 00000000
1001d020 | 00000000 00000000 00000000 00000000
1001d030 | 00a083f1 000003ff 00100000 00000000
1001d040 | 00000000 00000000 00020303 000000ff
1001d050 | 00000000 00000000 00000000 00000000
1001d060 | 00000002 00000000 00000000 00000000
drm: 500 = 0x8 
[DDR Reserve] ddr reserve mode not be enabled yet
DDR RESERVE Success 0
[EMI] ComboMCP not ready, using default setting
BYTE_swap:0 
BYTE_swap:0 
Window Sum 560, worse bit 0, min window 68
Window Sum 564, worse bit 9, min window 68
[TxChooseVref] Worse bit 8, Min win 25, Win sum 413, Final Vref 36
Window Sum 86, worse bit 3, min window 6
Window Sum 146, worse bit 11, min window 12
Window Sum 150, worse bit 3, min window 8
Window Sum 234, worse bit 11, min window 24
Window Sum 208, worse bit 3, min window 16
Window Sum 266, worse bit 11, min window 30
Window Sum 256, worse bit 3, min window 20
Window Sum 292, worse bit 11, min window 32
Window Sum 288, worse bit 3, min window 26
Window Sum 312, worse bit 11, min window 36
Window Sum 318, worse bit 3, min window 30
Window Sum 340, worse bit 10, min window 40
Window Sum 340, worse bit 3, min window 36
Window Sum 356, worse bit 10, min window 42
Window Sum 360, worse bit 3, min window 40
Window Sum 366, worse bit 11, min window 42
Window Sum 372, worse bit 2, min window 44
Window Sum 386, worse bit 11, min window 46
Window Sum 388, worse bit 3, min window 44
Window Sum 406, worse bit 11, min window 48
Window Sum 402, worse bit 3, min window 46
Window Sum 418, worse bit 10, min window 50
Window Sum 414, worse bit 3, min window 48
Window Sum 432, worse bit 10, min window 52
Window Sum 426, worse bit 3, min window 48
Window Sum 446, worse bit 9, min window 54
Window Sum 436, worse bit 3, min window 52
Window Sum 454, worse bit 10, min window 54
Window Sum 440, worse bit 3, min window 52
Window Sum 462, worse bit 10, min window 54
Window Sum 452, worse bit 3, min window 54
Window Sum 478, worse bit 10, min window 56
Window Sum 456, worse bit 1, min window 56
Window Sum 464, worse bit 0, min window 58
Window Sum 478, worse bit 10, min window 58


U-Boot 2022.07-rc3 (Sep 07 2022 - 18:38:32 +0800)

CPU:   MediaTek MT7981
Model: mt7981-rfb
DRAM:  512 MiB
Core:  28 devices, 15 uclasses, devicetree: embed

Initializing NMBM ...
spi-nand: spi_nand spi_nand@0: Macronix SPI NAND was found.
spi-nand: spi_nand spi_nand@0: 256 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
Could not find a valid device for nmbm0
Signature found at block 2047 [0x0ffe0000]
First info table with writecount 0 found in block 2016
Second info table with writecount 0 found in block 2019
NMBM has been successfully attached 

Loading Environment from MTD... *** Warning - bad CRC, using default environment

In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:   
Warning: ethernet@15100000 (eth0) using random MAC address - e2:e8:44:8d:2f:58
eth0: ethernet@15100000

*** Upgrading Firmware ***

ethernet@15100000 Waiting for PHY auto negotiation to complete...... done
Using ethernet@15100000 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'openwrt-gl-mt3000.bin'.
Load address: 0x46000000
Loading: T T T T 
Retry count exceeded; starting again

*** TFTP client failure: -64 ***
*** Operation Aborted! ***
Enter "gl" to stop autoboot in 2 seconds
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 246 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 1970, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 1926, total reserved PEBs: 44, PEBs reserved for bad PEB handling: 40
Reading from volume 'kernel' to 0x46000000, size 0x0 ... *** Cannot find volume 'kernel' ***
MT7981>
8

Although it did not work at my side, but at least I had new output which means that the programmer is working fine.

Now the problem is the correct U-Boot file, and this can be overcome by compiling U-Boot from scratch from a source code (I think but not sure)

9

Have you updated U-Boot on your device?

10

I didn’t update uboot;

I think the point is you have to write BL2 to address 0x00 and write FIP(uboot getting from here) to address 0x380000

11

WoooW, it works very well now :partying_face: :partying_face: :grin: :clap: :clap:
Thanks a lot @dengxinfa

Do me a favor plz and explain to me why it work now after I wrote BL2 at 0xx and FIP at 0x380000?

Many thanks once again