Miwifi 3G - how to unbrick

Yes have tried turning flow control off and hitting 2 all the time, does not seems to make any difference.

edit: should I try a different terminal?

Poor soldering is often a cause of non-responsive serial.

I'm also confused, since the instructions at https://openwrt.org/toh/xiaomi/mir3g#installation seem not to cover what you're trying to do. Which instructions are you following?

Edit: You might want to edit your thread title, as you don't have a boot loop with known-good firmware, you need help installing firmware.

1 Like

youtube for serial connection, https://openwrt.org/toh/xiaomi/mir3g#oem_installation_using_the_tftp_method for serial settings
Not much on openwrt pages. Instruction too general.

They seem very specific to me for either the SSH or the USB technique.

1 Like

Just need to unbrick now.

2 Likes

I used the SSH method, but followed a different instruction that does not have
run: nvram set flag_try_sys1_failed=1

but instead has
nvram set flag_last_success=1

It's from Xiaomi WiFi Router 3G - #57 by hammer which is also referred to on the openwrt page.

1 Like
  • Is that procedure working for you?
  • When you're more familiar with the community, would you be willing to add that to the Wiki?

It's not working, resulting in endless reboot.

I will do so.

Anyone can assist in this situation?

I managed to copy the log using another serial terminal - Termite.

Anyone can help me to unbrick it?


===================================================================

     		MT7621   stage1 code 10:33:11 (ASIC)

     		CPU=50000000 HZ BUS=12500000 HZ

==================================================================

Change MPLL source from XTAL to CR...

do MEMPLL setting..

MEMPLL Config : 0x11100000

3PLL mode + External loopback

=== XTAL-40Mhz === DDR-1200Mhz ===

PLL2 FB_DL: 0x10, 1/0 = 619/405 41000000

PLL4 FB_DL: 0x12, 1/0 = 589/435 49000000

PLL3 FB_DL: 0x19, 1/0 = 535/489 65000000

do DDR setting..[00320381]

Apply DDR3 Setting...(use customer AC)

          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120

      --------------------------------------------------------------------------------

0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    1    1

000E:|    0    0    0    0    0    0    0    0    1    1    1    1    1    1    1    1

000F:|    0    0    0    1    1    1    1    1    1    1    1    1    1    1    0    0

0010:|    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0    0

0011:|    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0    0

0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0

rank 0 coarse = 15

rank 0 fine = 64

B:|    0    0    0    0    0    0    0    0    0    1    1    1    0    0    0    0

opt_dle value:10

DRAMC_R0DELDLY[018]=00001F21

==================================================================

		RX	DQS perbit delay software calibration 

==================================================================

1.0-15 bit dq delay value

==================================================================

bit|     0  1  2  3  4  5  6  7  8  9

--------------------------------------

0 |    9 6 9 7 5 6 7 6 4 6 

10 |    6 7 8 7 6 7 

--------------------------------------



==================================================================

2.dqs window

x=pass dqs delay value (min~max)center 

y=0-7bit DQ of every group

input delay:DQS0 =33 DQS1 = 31

==================================================================

bit	DQS0	 bit      DQS1

0  (1~62)31  8  (0~58)29

1  (1~61)31  9  (1~61)31

2  (1~64)32  10  (1~61)31

3  (1~58)29  11  (0~57)28

4  (1~60)30  12  (1~61)31

5  (1~62)31  13  (1~59)30

6  (1~62)31  14  (1~61)31

7  (1~66)33  15  (1~61)31

==================================================================

3.dq delay value last

==================================================================

bit|    0  1  2  3  4  5  6  7  8   9

--------------------------------------

0 |    11 8 10 11 8 8 9 6 6 6 

10 |    6 10 8 8 6 7 

==================================================================

==================================================================

     TX  perbyte calibration 

==================================================================

DQS loop = 15, cmp_err_1 = ffff0000 

dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1 

dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2 

DQ loop=15, cmp_err_1 = ffff00a2

dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=1 

DQ loop=14, cmp_err_1 = ffff0000

dqs_perbyte_dly.last_dqdly_pass[0]=14,  finish count=2 

byte:0, (DQS,DQ)=(8,8)

byte:1, (DQS,DQ)=(8,8)

20,data:88

[EMI] DRAMC calibration passed




===================================================================

     		MT7621   stage1 code done 

     		CPU=50000000 HZ BUS=12500000 HZ

===================================================================



U-Boot 1.1.3 (Sep 25 2018 - 12:07:27)


Board: Ralink APSoC DRAM:  256 MB

Power on memory test. Memory size= 256 MB...2
OK!

relocate_code Pointer at: 8ffac000


Config XHCI 40M PLL 

******************************

Software System Reset Occurred

******************************

Allocate 16 byte aligned buffer: 8ffe0030

Enable NFI Clock

# MTK NAND # : Use HW ECC

NAND ID [C8 D1 80 95 40]

Device found in MTK table, ID: c8d1, EXT_ID: 809540

Support this Device in MTK table! c8d1 

select_chip

[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16

Signature matched and data read!

load_fact_bbt success 1023

load fact bbt success

[mtk_nand] probe successfully!

mtd->writesize=2048 mtd->oobsize=64,	mtd->erasesize=131072  devinfo.iowidth=8

..============================================ 

Ralink UBoot Version: 5.0.0.0

-------------------------------------------- 

ASIC MT7621A DualCore (MAC to MT7530 Mode)

DRAM_CONF_FROM: Auto-Detection 

DRAM_TYPE: DDR3 

DRAM bus: 16 bit

Xtal Mode=5 OCP Ratio=1/4

Flash component: NAND Flash

Date:Sep 25 2018  Time:12:07:27

============================================ 

icache: sets:256, ways:4, linesz:32 ,total:32768

dcache: sets:256, ways:4, linesz:32 ,total:32768 


 ##### The CPU freq = 880 MHZ #### 

 estimate memory size =256 Mbytes

#Reset_MT7530

set LAN/WAN LWLLL


Please choose the operation: 

   1: Load system code to SDRAM via TFTP. 

   2: Load system code then write to Flash via TFTP. 

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   7: Load Boot Loader code then write to Flash via Serial. 

   9: Load Boot Loader code then write to Flash via TFTP. 



You choosed 3


 0 

Booting System 2

..ranand_erase: start:80000, len:20000 

..Done!

done

   

3: System Boot system code via Flash.

## Booting image at bc600000 ...

   Image Name:   MIPS OpenWrt Linux-4.14.95

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    1834318 Bytes =  1.7 MB

   Load Address: 80001000

   Entry Point:  80001000

............................   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

commandline uart_en=0 factory_mode=0 usb_u3=0

No initrd

## Transferring control to Linux (at address 80001000) ...

## Giving linux memsize in MB, 256


Starting kernel ...


[    0.000000] Linux version 4.14.95 (buildbot@builds-03.infra.lede-project.org) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r7627-753531d)) #0 SMP Mon Jan 28 08:54:32 2019
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is Xiaomi Mi Router 3G
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 10000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000]   HighMem  empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] random: get_random_bytes called from 0x80555740 with crng_init=0
[    0.000000] percpu: Embedded 14 pages/cpu @81210000 s26256 r8192 d22896 u57344
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 65024
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Writing ErrCtl register=00061440
[    0.000000] Readback ErrCtl register=00061440
[    0.000000] Memory: 253616K/262144K available (4636K kernel code, 239K rwdata, 572K rodata, 236K init, 254K bss, 8528K reserved, 0K cma-reserved, 0K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] Hierarchical RCU implementation.
[    0.000000] NR_IRQS: 256
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
[    0.000010] sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 4880645118ns
[    0.007813] Calibrating delay loop... 586.13 BogoMIPS (lpj=2930688)
[    0.073979] pid_max: default: 32768 minimum: 301
[    0.078752] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.085261] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.094065] Hierarchical SRCU implementation.
[    0.099217] smp: Bringing up secondary CPUs ...
[    0.104567] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.104577] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.104589] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.104726] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.163966] Synchronize counters for CPU 1: done.
[    0.198715] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.198725] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.198734] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.198804] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.255123] Synchronize counters for CPU 2: done.
[    0.285750] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.285758] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.285767] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.285843] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.340300] Synchronize counters for CPU 3: done.
[    0.370163] smp: Brought up 1 node, 4 CPUs
[    0.377778] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.387569] futex hash table entries: 1024 (order: 3, 32768 bytes)
[    0.393867] pinctrl core: initialized pinctrl subsystem
[    0.399678] NET: Registered protocol family 16
[    0.409849] Can't analyze schedule() prologue at 804829e0
[    0.415890] pull PCIe RST: RALINK_RSTCTRL = 4000000
[    0.721142] release PCIe RST: RALINK_RSTCTRL = 7000000
[    0.726175] ***** Xtal 40MHz *****
[    0.729547] release PCIe RST: RALINK_RSTCTRL = 7000000
[    0.734655] Port 0 N_FTS = 1b105000
[    0.738098] Port 1 N_FTS = 1b105000
[    0.741557] Port 2 N_FTS = 1b102800
[    1.896858] PCIE2 no card, disable it(RST&CLK)
[    1.901202]  -> 21007f2
[    1.903622] PCIE0 enabled
[    1.906228] PCIE1 enabled
[    1.908813] PCI host bridge /pcie@1e140000 ranges:
[    1.913578]  MEM 0x0000000060000000..0x000000006fffffff
[    1.918761]   IO 0x000000001e160000..0x000000001e16ffff
[    1.923933] PCI coherence region base: 0xbfbf8000, mask/settings: 0x60000000
[    1.939462] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    1.945310] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    1.951016] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    1.958124] PCI host bridge to bus 0000:00
[    1.962160] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    1.969011] pci_bus 0000:00: root bus resource [io  0xffffffff]
[    1.974845] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    1.981601] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.991675] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    1.998187] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    2.005128] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    2.011669] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    2.018601] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    2.025325] pci 0000:00:01.0: BAR 8: assigned [mem 0x60100000-0x601fffff]
[    2.032078] pci 0000:00:01.0: BAR 9: assigned [mem 0x60200000-0x602fffff pref]
[    2.039227] pci 0000:00:00.0: BAR 1: assigned [mem 0x60300000-0x6030ffff]
[    2.045992] pci 0000:00:01.0: BAR 1: assigned [mem 0x60310000-0x6031ffff]
[    2.052722] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff]
[    2.059477] pci 0000:00:00.0: PCI bridge to [bus 01]
[    2.064375] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    2.071140] pci 0000:02:00.0: BAR 0: assigned [mem 0x60100000-0x601fffff 64bit]
[    2.078385] pci 0000:02:00.0: BAR 6: assigned [mem 0x60200000-0x6020ffff pref]
[    2.085564] pci 0000:00:01.0: PCI bridge to [bus 02]
[    2.090463] pci 0000:00:01.0:   bridge window [mem 0x60100000-0x601fffff]
[    2.097222] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff pref]
[    2.105741] clocksource: Switched to clocksource GIC
[    2.112273] NET: Registered protocol family 2
[    2.117352] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    2.124238] TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
[    2.130692] TCP: Hash tables configured (established 2048 bind 2048)
[    2.137095] UDP hash table entries: 256 (order: 1, 8192 bytes)
[    2.142858] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
[    2.149327] NET: Registered protocol family 1
[    2.385699] 4 CPUs re-calibrate udelay(lpj = 2924544)
[    2.391977] Crashlog allocated RAM at address 0x3f00000
[    2.397570] workingset: timestamp_bits=30 max_order=16 bucket_order=0
[    2.411399] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    2.417217] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    2.428721] random: fast init done
[    2.433731] io scheduler noop registered
[    2.437606] io scheduler deadline registered (default)
[    2.443307] gpio-export gpio_export: 1 gpio(s) exported
[    2.449317] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    2.458610] console [ttyS0] disabled
[    2.462168] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 18, base_baud = 3125000) is a 16550A
[    2.471217] console [ttyS0] enabled
[    2.471217] console [ttyS0] enabled
[    2.478098] bootconsole [early0] disabled
[    2.478098] bootconsole [early0] disabled
[    2.486979] cacheinfo: Failed to find cpu0 device node
[    2.492106] cacheinfo: Unable to detect cache hierarchy for CPU 0
[    2.499038] MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
[    2.506167] Enable NFI Clock
[    2.509038] # MTK NAND # : Use HW ECC
[    2.512698] Device found in MTK table, ID: c8d1, EXT_ID: 809540
[    2.518630] Support this Device in MTK table! c8d1 

[    2.523579] [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
[    2.530052] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xd1
[    2.536387] nand: ESMT NAND 128MiB 3,3V 8-bit
[    2.540724] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    2.548287] Scanning device for bad blocks
[    2.696301] 10 fixed-partitions partitions found on MTD device MT7621-NAND
[    2.703143] Creating 10 MTD partitions on "MT7621-NAND":
[    2.708451] 0x000000000000-0x000000080000 : "Bootloader"
[    2.714712] 0x000000080000-0x0000000c0000 : "Config"
[    2.720550] 0x0000000c0000-0x000000100000 : "Bdata"
[    2.726350] 0x000000100000-0x000000140000 : "Factory"
[    2.732230] 0x000000140000-0x000000180000 : "crash"
[    2.738032] 0x000000180000-0x0000001c0000 : "crash_syslog"
[    2.744365] 0x0000001c0000-0x000000200000 : "reserved0"
[    2.750486] 0x000000200000-0x000000600000 : "kernel_stock"
[    2.756909] 0x000000600000-0x000000a00000 : "kernel"
[    2.762746] 0x000000a00000-0x000007f80000 : "ubi"
[    2.769331] [mtk_nand] probe successfully!
[    2.774143] Signature matched and data read!
[    2.778406] load_fact_bbt success 1023
[    2.782801] libphy: Fixed MDIO Bus: probed
[    2.858305] libphy: mdio: probed
[    4.261991] mtk_soc_eth 1e100000.ethernet: loaded mt7530 driver
[    4.268683] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 20
[    4.279524] NET: Registered protocol family 10
[    4.285360] Segment Routing with IPv6
[    4.289151] NET: Registered protocol family 17
[    4.293632] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    4.306545] 8021q: 802.1Q VLAN Support v1.8
[    4.313782] UBI error: no valid UBI magic found inside mtd9
[    4.319399] hctosys: unable to open rtc device (rtc0)
[    4.325205] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    4.332670] Please append a correct "root=" boot option; here are the available partitions:
[    4.341005] 1f00             512 mtdblock0 
[    4.341011]  (driver?)
[    4.347526] 1f01             256 mtdblock1 
[    4.347531]  (driver?)
[    4.354031] 1f02             256 mtdblock2 
[    4.354035]  (driver?)
[    4.360550] 1f03             256 mtdblock3 
[    4.360554]  (driver?)
[    4.367069] 1f04             256 mtdblock4 
[    4.367073]  (driver?)
[    4.373574] 1f05             256 mtdblock5 
[    4.373578]  (driver?)
[    4.380092] 1f06             256 mtdblock6 
[    4.380096]  (driver?)
[    4.386610] 1f07            4096 mtdblock7 
[    4.386614]  (driver?)
[    4.393115] 1f08            4096 mtdblock8 
[    4.393119]  (driver?)
[    4.399633] 1f09          120320 mtdblock9 
[    4.399638]  (driver?)
[    4.406150] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    4.416270] Rebooting in 1 seconds..

I entered 2 after u-Boot appeared and before it boots as previously suggested but it seems to just ignore me and keeps booting.

I have found some useful information.

According to https://openwrt.org/toh/xiaomi/mir3

"Writing to the console in the factory firmware is only possible during first boot; afterwards it is disabled by the firmware."

Hello,
I'm facing the same problem, were you able To solve it ?

@kampua
did you found any way to solve it?