Miwifi 3G - how to unbrick

Hi,

Newbie here.

I bricked my xiaomi miwifi 3g while upgrading to OpenWRT.

I managed to establish serial connection and sees that the unit is locked in endless reboot. Saw instruction to boot using option 2 in U-boot. Question is how do I do that as the unit is rebooting endlessly and there is no delay before it booted directly using option 3.

Can anyone help?

It's booting OpenWRT kernel but I get the following error

VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6

What you're seeing is that init can't find the root file system. This could be because either the file system that is expected by the kernel doesn't exist, the driver for it isn't attaching, or the kernel is getting the "wrong" command line (telling it to use a file system that doesn't exist).

Would you be able to post the logs up to that point? The preformatted-text button, </> can help make it more readable.

1 Like

Does it help if you start reading here? -

https://openwrt.org/toh/xiaomi/mir3g#oem_installation_using_the_tftp_method

It appears the TFTP information isn't filled in on the Wiki page.

  • Can you post what you seeeing?
  • Have you tried hitting CTRL+C or ESC?

Thanks for the suggestions, I tried CTRL+C and ESC but it keeps going.

Copy the log out of the Putty window

I read that I need to take option 2 at Uboot. But it goes so fast I can't choose anything in uboot menu.

 2.508161] # MTK NAND # : Use HW ECC
[    2.511824] Device found in MTK table, ID: c8d1, EXT_ID: 809540
[    2.517810] Support this Device in MTK table! c8d1
[    2.522759] [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
[    2.529231] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xd1
[    2.535552] nand: ESMT NAND 128MiB 3,3V 8-bit
[    2.539900] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    2.547464] Scanning device for bad blocks
[    2.695495] 10 fixed-partitions partitions found on MTD device MT7621-NAND
[    2.702352] Creating 10 MTD partitions on "MT7621-NAND":
[    2.707661] 0x000000000000-0x000000080000 : "Bootloader"
[    2.713890] 0x000000080000-0x0000000c0000 : "Config"
[    2.719725] 0x0000000c0000-0x000000100000 : "Bdata"
[    2.725439] 0x000000100000-0x000000140000 : "Factory"
[    2.731363] 0x000000140000-0x000000180000 : "crash"
[    2.737163] 0x000000180000-0x0000001c0000 : "crash_syslog"
[    2.743566] 0x0000001c0000-0x000000200000 : "reserved0"
[    2.749681] 0x000000200000-0x000000600000 : "kernel_stock"
[    2.756054] 0x000000600000-0x000000a00000 : "kernel"
[    2.761941] 0x000000a00000-0x000007f80000 : "ubi"
[    2.768480] [mtk_nand] probe successfully!
[    2.773294] Signature matched and data read!
[    2.777559] load_fact_bbt success 1023
[    2.781881] libphy: Fixed MDIO Bus: probed
[    2.858950] libphy: mdio: probed
[    4.262775] mtk_soc_eth 1e100000.ethernet: loaded mt7530 driver
[    4.269524] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 20
[    4.280439] NET: Registered protocol family 10
[    4.286312] Segment Routing with IPv6
[    4.290107] NET: Registered protocol family 17
[    4.294592] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    4.307506] 8021q: 802.1Q VLAN Support v1.8
[    4.314724] UBI error: no valid UBI magic found inside mtd9
[    4.320381] hctosys: unable to open rtc device (rtc0)
[    4.326200] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    4.333668] Please append a correct "root=" boot option; here are the available partitions:
[    4.342007] 1f00             512 mtdblock0
[    4.342014]  (driver?)
[    4.348530] 1f01             256 mtdblock1
[    4.348535]  (driver?)
[    4.355035] 1f02             256 mtdblock2
[    4.355039]  (driver?)
[    4.361560] 1f03             256 mtdblock3
[    4.361565]  (driver?)
[    4.368079] 1f04             256 mtdblock4
[    4.368084]  (driver?)
[    4.374584] 1f05             256 mtdblock5
[    4.374588]  (driver?)
[    4.381108] 1f06             256 mtdblock6
[    4.381114]  (driver?)
[    4.387629] 1f07            4096 mtdblock7
[    4.387633]  (driver?)
[    4.394136] 1f08            4096 mtdblock8
[    4.394139]  (driver?)
[    4.400664] 1f09          120320 mtdblock9
[    4.400669]  (driver?)
[    4.407184] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    4.417303] Rebooting in 1 seconds..
U-Boot 1.1.3 (Sep 25 2018 - 12:07:27)

Board: Ralink APSoC DRAM:  256 MB
Power on memory test. Memory size= 256 MB...OK!
relocate_code Pointer at: 8ffac000

Config XHCI 40M PLL
******************************
Software System Reset Occurred
******************************
Allocate 16 byte aligned buffer: 8ffe0030
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C8 D1 80 95 40]
Device found in MTK table, ID: c8d1, EXT_ID: 809540
Support this Device in MTK table! c8d1
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 1023
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
..============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=5 OCP Ratio=1/4
Flash component: NAND Flash
Date:Sep 25 2018  Time:12:07:27
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
#Reset_MT7530
set LAN/WAN LWLLL

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 3
                                                                                                                                                                                                                                           0
Booting System 2
..ranand_erase: start:80000, len:20000
..Done!
done

3: System Boot system code via Flash.
## Booting image at bc600000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.95
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1834318 Bytes =  1.7 MB
   Load Address: 80001000
   Entry Point:  80001000

@kampua, you wasted 5 posts by making individual responses!!! Use only one post to answer multiple inquires in the thread, as we can all see them.

  • Please follow @jeff's advice and use the </> icon to paste code and terminal output - please edit those posts
  • If you are not getting any response from the terminal, make sure your Hardware and Software Flow control settings are correct.

This suggests that the image was not valid or was not flashed properly.

The preformatted-text button is this one
image

Edit: This may be due to the flashing process. I don't know what the key is to stop U-Boot as I don't see a prompt for it. On a device that I have, the [space] key at the proper moment will stop it. Sometimes it can be entered after U-Boot has started, but before the "stop now" prompt comes up.

Prompt is shown in the code below, but it is so fast.

Flash component: NAND Flash
Date:Sep 25 2018  Time:12:07:27
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
#Reset_MT7530
set LAN/WAN LWLLL

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 3
                                                                                                                                                                                                                                           0
Booting System 2
..ranand_erase: start:80000, len:20000
..Done!
done

3: System Boot system code via Flash.
## Booting image at bc600000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.95
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1834318 Bytes =  1.7 MB
   Load Address: 80001000

Edit: I am unable to capture the full log.

https://forms.na1.netsuite.com/app/site/hosting/scriptlet.nl?script=457&deploy=2&compid=818164&h=5928a16f2b6f9582b799&article=how-to-capture-session-logs-using-putty

Look for Category Session -> Logging

Under Session Logging, choose “ All session output ” and key in your desired log filename (the default is putty.log).

You will need to stop U-Boot to make the choice. Try your desired selection (2?) before asked, but after U-Boot has started.

putty flow control is on XON/XOFF, I read on the web that it has to be software handshaking not hardware. And I read that XON/XOFF is software handshaking.

I'm suggesting you change it in order to test - and not just stare at an unresponsive screen seeking a different result.

I've often times had to change a flow control settings to get a terminal running. If it doesn't work, nothing lost.

  • Also have you tried CTRL+S and SPACEBAR

Yes have tried those but not working.

If type-ahead of your choice doesn't work, then I would definitely try turning off all flow control. (I've never needed any change to the default flow control with the `nix utilities of screen or miniterm.py to work with U-Boot.)

Edit: Hardware flow control is guaranteed to be useless with a typical RX/TX/GND connection as it relies on other lines being connected.

Yea...this sounds like an improper Serial setting.

I thought of that; because I have to flip flow control settings for my Meraki MX60W to take Serial input (it also uses U-Boot).

Tried all handshakings, does not seems to make any difference.

Have you disabled all flow control, including software, and tried to hit the [2] key after U-Boot has started, but before the "please select" prompt? Have you tried hitting the [2] key repeatedly during that time?