Xiaomi mi router 3 pro r3p bootloop

ajw107 · June 9, 2020, 12:40am

Hi
I've been experimenting with compiling my own version of OpenWRT. This was going well until my last update where I managed to brick my Xiaomi R3P (two of them actually). Luckily I have a UART cable and a TTL Serial header soldiered onto the board, and assumed I could recover using that (that's how I installed OpenWRT). Unfortunately it no longer seems to work. This is what's happening, and what I've tried (on both routers):

I can see output from the serial console, but I appear to only have read access, I can't send any key presses
I have tried turning flow control on and off in putty, no change
I have tried turning Local Echo to Forced, I can see what I type now, but the router does not respond to key presses still
I have changed to Termite instead of Putty, same problems
I have tried different wires, no difference
I have tried with a ethernet cable plugged into each W/Lan port in turn, no difference (direct connection to my computer with a static ip of 192.168.1.2)
The boot menu doesn't pause anymore, and just flies past with the default option (so I am unable to tftp boot)
I've created 3 FAT32 USB keys with Xiaomi's development firmware, renamed to miwifi.bin, then power on the router with the reset button pressed, but it never tries to load the firmware off any of the USB drives
The front LED is solid Orange (apart from a brief flash when it reboots)

Boot Logs in next message, as too large for one message.

Any help would be very much appreciated, I'm completely lost for ideas.

ajw107 · June 9, 2020, 12:41am

Here is a copy of one of the boot logs:

===================================================================
                MT7621   stage1 code May 28 2018 14:51:28 (ASIC)
                CPU=50000000 HZ BUS=16666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL2 FB_DL: 0x8, 1/0 = 685/339 21000000
PLL3 FB_DL: 0xb, 1/0 = 536/488 2D000000
PLL4 FB_DL: 0xe, 1/0 = 623/401 39000000
do DDR setting..[00320381]
Apply DDR3 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000E:|    0    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1
000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    1    0    0
0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0
0011:|    1    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
DRAMC_DQSCTL1[0e0]=13000000
DRAMC_DQSGCTL[124]=80000033
rank 0 coarse = 15
rank 0 fine = 72
B:|    0    0    0    0    0    0    0    0    0    0    1    1    1    0    0    0
opt_dle value:11
DRAMC_DDR2CTL[07c]=C287223D
DRAMC_PADCTL4[0e4]=000044B3
DRAMC_DQIDLY1[210]=09060506
DRAMC_DQIDLY2[214]=06060607
DRAMC_DQIDLY3[218]=0A070507
DRAMC_DQIDLY4[21c]=09070A08
DRAMC_R0DELDLY[018]=00001E1D
==================================================================
                RX      DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    5 4 5 8 7 5 5 6 4 3
10 |    6 7 7 8 7 7
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =29 DQS1 = 30
==================================================================
bit     DQS0     bit      DQS1
0  (1~56)28  8  (1~54)27
1  (1~55)28  9  (1~56)28
2  (0~56)28  10  (1~58)29
3  (1~55)28  11  (1~54)27
4  (1~57)29  12  (1~57)29
5  (1~56)28  13  (1~56)28
6  (1~56)28  14  (1~60)30
7  (1~58)29  15  (1~55)28
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    6 5 6 9 7 6 6 6 7 5
10 |    7 10 8 10 7 9
==================================================================
==================================================================
     TX  perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2
DQ loop=15, cmp_err_1 = ffff0002
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=1
DQ loop=14, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=14,  finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:88
[EMI] DRAMC calibration passed

===================================================================
                MT7621   stage1 code done
                CPU=50000000 HZ BUS=16666666 HZ
===================================================================


U-Boot 1.1.3 (Aug  6 2019 - 06:27:58)

Board: Ralink APSoC DRAM:  256 MB
Power on memory test. Memory size= 256 MB...OK!
relocate_code Pointer at: 8ffac000

Config XHCI 40M PLL
Allocate 16 byte aligned buffer: 8ffe0010
Enable NFI Clock
# MTK NAND # : Use HW ECC
NAND ID [C8 DA 90 95 44]
Device found in MTK table, ID: c8da, EXT_ID: 909544
Support this Device in MTK table! c8da
select_chip
[NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
Signature matched and data read!
load_fact_bbt success 2047
load fact bbt success
[mtk_nand] probe successfully!
mtd->writesize=2048 mtd->oobsize=64,    mtd->erasesize=131072  devinfo.iowidth=8
..============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: NAND Flash
Date:Aug  6 2019  Time:06:27:58
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =256 Mbytes
#Reset_MT7530
set LAN/WAN LLLLW

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 3
                                                                              0
Booting System 2
..ranand_erase: start:40000, len:20000
..Done!
done

3: System Boot system code via Flash.
## Booting image at bc600000 ...
   Image Name:   MIPS OpenWrt Linux-5.4.42
   Image Type:   MIPS Linux Kernel Image (uncompressed)
   Data Size:    2282517 Bytes =  2.2 MB
   Load Address: 80001000
   Entry Point:  80001000
...................................   Verifying Checksum ... OK
OK
commandline uart_en=0 factory_mode=0 usb_u3=0
No initrd
## Transferring control to Linux (at address 80001000) ...
## Giving linux memsize in MB, 256

Starting kernel ...



OpenWrt kernel loader for MIPS based SoC
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80001000...

[    0.000000] Linux version 5.4.42 (builder@buildhost) (gcc version 8.4.0 (OpenWrt GCC 8.4.0 r13409-4bd7990488)) #0 SMP Sun May 31 09:03:31 2020
[    0.000000] SoC Type: MediaTek MT7621 ver:1 eco:3
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 0001992f (MIPS 1004Kc)
[    0.000000] MIPS: machine is Xiaomi Mi Router 3 Pro
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] VPE topology {2,2} total 4
[    0.000000] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000]   HighMem  [mem 0x0000000010000000-0x0000000023ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000001bffffff]
[    0.000000]   node   0: [mem 0x0000000020000000-0x0000000023ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000023ffffff]
[    0.000000] percpu: Embedded 14 pages/cpu s26704 r8192 d22448 u57344
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 130496
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes, linear)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Writing ErrCtl register=00009e55
[    0.000000] Readback ErrCtl register=00009e55
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 510308K/524288K available (5835K kernel code, 205K rwdata, 724K rodata, 1288K init, 237K bss, 13980K reserved, 0K cma-reserved, 262144K highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Hierarchical RCU implementation.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[    0.000000] NR_IRQS: 256
[    0.000000] random: get_random_bytes called from 0x8069ea10 with crng_init=0
[    0.000000] CPU Clock: 880MHz
[    0.000000] clocksource: GIC: mask: 0xffffffffffffffff max_cycles: 0xcaf478abb4, max_idle_ns: 440795247997 ns
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 4343773742 ns
[    0.000010] sched_clock: 32 bits at 440MHz, resolution 2ns, wraps every 4880645118ns
[    0.007808] Calibrating delay loop... 583.68 BogoMIPS (lpj=1167360)
[    0.042013] pid_max: default: 32768 minimum: 301
[    0.046796] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.054022] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.064551] rcu: Hierarchical SRCU implementation.
[    0.070021] smp: Bringing up secondary CPUs ...
[    2.286648] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    2.286658] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    2.286671] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    2.286774] CPU1 revision is: 0001992f (MIPS 1004Kc)
[    0.102809] Synchronize counters for CPU 1: done.
[    2.348058] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    2.348065] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    2.348073] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    2.348134] CPU2 revision is: 0001992f (MIPS 1004Kc)
[    0.167549] Synchronize counters for CPU 2: done.
[    2.409371] Primary instruction cache 32kB, VIPT, 4-way, linesize 32 bytes.
[    2.409380] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    2.409389] MIPS secondary cache 256kB, 8-way, linesize 32 bytes.
[    2.409452] CPU3 revision is: 0001992f (MIPS 1004Kc)
[    0.225414] Synchronize counters for CPU 3: done.
[    0.255287] smp: Brought up 1 node, 4 CPUs
[    0.263897] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[    0.273590] futex hash table entries: 1024 (order: 3, 32768 bytes, linear)
[    0.280692] pinctrl core: initialized pinctrl subsystem
[    0.287696] NET: Registered protocol family 16
[    0.316189] random: fast init done
[    0.324148] clocksource: Switched to clocksource GIC
[    0.331305] NET: Registered protocol family 2
[    0.336953] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 6144 bytes, linear)
[    0.345332] TCP established hash table entries: 2048 (order: 1, 8192 bytes, linear)
[    0.352929] TCP bind hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.360014] TCP: Hash tables configured (established 2048 bind 2048)
[    0.366451] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.372935] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.380150] NET: Registered protocol family 1
[    0.384466] PCI: CLS 0 bytes, default 32
[    0.480112] 4 CPUs re-calibrate udelay(lpj = 1167360)
[    0.486806] workingset: timestamp_bits=14 max_order=17 bucket_order=3
[    0.505285] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.511076] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.522520] bounce: pool size: 64 pages
[    0.527998] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.533892] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.539721] mt7621_gpio 1e000600.gpio: registering 32 gpios
[    0.546144] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.556198] printk: console [ttyS0] disabled
[    0.560483] 1e000c00.uartlite: ttyS0 at MMIO 0x1e000c00 (irq = 19, base_baud = 3125000) is a 16550A
[    0.569469] printk: console [ttyS0] enabled
[    0.569469] printk: console [ttyS0] enabled
[    0.577727] printk: bootconsole [early0] disabled
[    0.577727] printk: bootconsole [early0] disabled
[    0.589652] mt7621-nand 1e003000.nand: Using programmed access timing: 31c07388
[    0.597108] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xda
[    0.603448] nand: ESMT NAND 256MiB 3,3V 8-bit
[    0.607802] nand: 256 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    0.615361] mt7621-nand 1e003000.nand: ECC strength adjusted to 4 bits
[    0.621918] mt7621-nand 1e003000.nand: Using programmed access timing: 31c07388
[    0.629217] Scanning device for bad blocks
[    3.723797] Bad eraseblock 1597 at 0x00000c7a0000
[    4.599624] 10 fixed-partitions partitions found on MTD device mt7621-nand
[    4.606491] Creating 10 MTD partitions on "mt7621-nand":
[    4.611808] 0x000000000000-0x000000040000 : "Bootloader"
[    4.618586] 0x000000040000-0x000000080000 : "Config"
[    4.624952] 0x000000080000-0x0000000c0000 : "Bdata"
[    4.631291] 0x0000000c0000-0x000000100000 : "factory"
[    4.637636] 0x000000100000-0x000000140000 : "crash"
[    4.643925] 0x000000140000-0x0000001c0000 : "crash_syslog"
[    4.650706] 0x0000001c0000-0x000000200000 : "reserved0"
[    4.657418] 0x000000200000-0x000000600000 : "kernel_stock"
[    4.664337] 0x000000600000-0x000000a00000 : "kernel"
[    4.670741] 0x000000a00000-0x00000ff80000 : "ubi"
[    4.679453] libphy: Fixed MDIO Bus: probed
[    4.710630] libphy: mdio: probed
[    4.714102] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    4.721915] mtk_soc_eth 1e100000.ethernet eth0: mediatek frame engine at 0xbe100000, irq 21
[    4.732585] mt7621-pci 1e140000.pcie: Parsing DT failed
[    4.740641] NET: Registered protocol family 10
[    4.746849] Segment Routing with IPv6
[    4.750690] NET: Registered protocol family 17
[    4.755272] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    4.768506] 8021q: 802.1Q VLAN Support v1.8
[    4.775264] mt7530 mdio-bus:1f: MT7530 adapts as multi-chip module
[    5.608516] libphy: dsa slave smi: probed
[    5.648199] mt7530 mdio-bus:1f lan3 (uninitialized): PHY [dsa-0.0:01] driver [Generic PHY]
[    5.668197] mt7530 mdio-bus:1f lan2 (uninitialized): PHY [dsa-0.0:02] driver [Generic PHY]
[    5.688205] mt7530 mdio-bus:1f lan1 (uninitialized): PHY [dsa-0.0:03] driver [Generic PHY]
[    5.708205] mt7530 mdio-bus:1f wan (uninitialized): PHY [dsa-0.0:04] driver [Generic PHY]
[    5.764140] mt7530 mdio-bus:1f: configuring for fixed/rgmii link mode
[    6.380136] mt7530 mdio-bus:1f: Link is Up - 1Gbps/Full - flow control off
[    6.456169] DSA: tree 0 setup
[    6.459499] rt2880-pinmux pinctrl: pcie is already enabled
[    6.465015] mt7621-pci 1e140000.pcie: Error applying setting, reverse things back
[    6.472630] mt7621-pci-phy 1e149000.pcie-phy: PHY for 0xbe149000 (dual port = 1)
[    6.480238] mt7621-pci-phy 1e14a000.pcie-phy: PHY for 0xbe14a000 (dual port = 0)
[    6.587756] mt7621-pci-phy 1e149000.pcie-phy: Xtal is 40MHz
[    6.593344] mt7621-pci-phy 1e14a000.pcie-phy: Xtal is 40MHz
[    6.698963] mt7621-pci 1e140000.pcie: pcie2 no card, disable it (RST & CLK)
[    6.705921] mt7621-pci 1e140000.pcie: PCIE0 enabled
[    6.710795] mt7621-pci 1e140000.pcie: PCIE1 enabled
[    6.715676] mt7621-pci 1e140000.pcie: PCI coherence region base: 0x60000000, mask/settings: 0xf0000002
[    6.725151] mt7621-pci 1e140000.pcie: PCI host bridge to bus 0000:00
[    6.731524] pci_bus 0000:00: root bus resource [io  0x1e160000-0x1e16ffff]
[    6.738397] pci_bus 0000:00: root bus resource [mem 0x60000000-0x6fffffff]
[    6.745276] pci_bus 0000:00: root bus resource [bus 00-ff]
[    6.750801] pci 0000:00:00.0: [0e8d:0801] type 01 class 0x060400
[    6.756840] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    6.763105] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    6.769441] pci 0000:00:00.0: supports D1
[    6.773455] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    6.779613] pci 0000:00:01.0: [0e8d:0801] type 01 class 0x060400
[    6.785665] pci 0000:00:01.0: reg 0x10: [mem 0x00000000-0x7fffffff]
[    6.791930] pci 0000:00:01.0: reg 0x14: [mem 0x00000000-0x0000ffff]
[    6.798253] pci 0000:00:01.0: supports D1
[    6.802267] pci 0000:00:01.0: PME# supported from D0 D1 D3hot
[    6.809354] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    6.817374] pci 0000:00:01.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    6.825592] pci 0000:01:00.0: [14c3:7615] type 00 class 0x000280
[    6.831659] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit]
[    6.838612] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5 GT/s x1 link)
[    6.853719] pci 0000:00:00.0: PCI bridge to [bus 01-ff]
[    6.858970] pci 0000:00:00.0:   bridge window [io  0x0000-0x0fff]
[    6.865064] pci 0000:00:00.0:   bridge window [mem 0x00000000-0x000fffff]
[    6.871853] pci 0000:00:00.0:   bridge window [mem 0x00000000-0x000fffff pref]
[    6.879080] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
[    6.885921] pci 0000:02:00.0: [14c3:7615] type 00 class 0x000280
[    6.891989] pci 0000:02:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit]
[    6.898942] pci 0000:02:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s x1 link at 0000:00:01.0 (capable of 4.000 Gb/s with 5 GT/s x1 link)
[    6.914069] pci 0000:00:01.0: PCI bridge to [bus 02-ff]
[    6.919318] pci 0000:00:01.0:   bridge window [io  0x0000-0x0fff]
[    6.925411] pci 0000:00:01.0:   bridge window [mem 0x00000000-0x000fffff]
[    6.932195] pci 0000:00:01.0:   bridge window [mem 0x00000000-0x000fffff pref]
[    6.939411] pci_bus 0000:02: busn_res: [bus 02-ff] end is updated to 02
[    6.946071] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
[    6.952683] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
[    6.959638] pci 0000:00:01.0: BAR 0: no space for [mem size 0x80000000]
[    6.966246] pci 0000:00:01.0: BAR 0: failed to assign [mem size 0x80000000]
[    6.973204] pci 0000:00:00.0: BAR 8: assigned [mem 0x60000000-0x600fffff]
[    6.979987] pci 0000:00:00.0: BAR 9: assigned [mem 0x60100000-0x601fffff pref]
[    6.987205] pci 0000:00:01.0: BAR 8: assigned [mem 0x60200000-0x602fffff]
[    6.993992] pci 0000:00:01.0: BAR 9: assigned [mem 0x60300000-0x603fffff pref]
[    7.001210] pci 0000:00:00.0: BAR 1: assigned [mem 0x60400000-0x6040ffff]
[    7.008005] pci 0000:00:01.0: BAR 1: assigned [mem 0x60410000-0x6041ffff]
[    7.014793] pci 0000:00:00.0: BAR 7: assigned [io  0x1e160000-0x1e160fff]
[    7.021579] pci 0000:00:01.0: BAR 7: assigned [io  0x1e161000-0x1e161fff]
[    7.028373] pci 0000:01:00.0: BAR 0: assigned [mem 0x60000000-0x600fffff 64bit]
[    7.035682] pci 0000:00:00.0: PCI bridge to [bus 01]
[    7.040652] pci 0000:00:00.0:   bridge window [io  0x1e160000-0x1e160fff]
[    7.047432] pci 0000:00:00.0:   bridge window [mem 0x60000000-0x600fffff]
[    7.054216] pci 0000:00:00.0:   bridge window [mem 0x60100000-0x601fffff pref]
[    7.061439] pci 0000:02:00.0: BAR 0: assigned [mem 0x60200000-0x602fffff 64bit]
[    7.068754] pci 0000:00:01.0: PCI bridge to [bus 02]
[    7.073719] pci 0000:00:01.0:   bridge window [io  0x1e161000-0x1e161fff]
[    7.080503] pci 0000:00:01.0:   bridge window [mem 0x60200000-0x602fffff]
[    7.087283] pci 0000:00:01.0:   bridge window [mem 0x60300000-0x603fffff pref]
[    7.095902] UBI: auto-attach mtd9
[    7.099294] ubi0: attaching mtd9
[    9.643359] ubi0: scanning is finished
[    9.666656] ubi0: attached mtd9 (name "ubi", size 245 MiB)
[    9.672170] ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
[    9.679026] ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
[    9.685798] ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
[    9.692743] ubi0: good PEBs: 1963, bad PEBs: 1, corrupted PEBs: 0
[    9.698819] ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
[    9.706026] ubi0: max/mean erase counter: 7/3, WL threshold: 4096, image sequence number: 2105545855
[    9.715132] ubi0: available PEBs: 0, total reserved PEBs: 1963, PEBs reserved for bad PEB handling: 39
[    9.724450] ubi0: background thread "ubi_bgt0d" started, PID 504
[    9.726893] block ubiblock0_1: created from ubi0:1(rootfs)
[    9.735997] ubiblock: device ubiblock0_1 (rootfs) set to be root filesystem
[    9.742958] hctosys: unable to open rtc device (rtc0)
[    9.756269] VFS: Mounted root (squashfs filesystem) readonly on device 254:0.
[    9.767921] Freeing unused kernel memory: 1288K
[    9.772513] This architecture does not have kernel memory protection.
[    9.778942] Run /sbin/init as init process
[   10.432567] init: Console is alive
[   10.436273] init: - watchdog -
[   10.495853] do_page_fault(): sending SIGSEGV to kmodloader for invalid read access from 77e2e063
[   10.504647] epc = 0040254c in kmodloader[400000+3000]
[   10.509708] ra  = 00401444 in kmodloader[400000+3000]
[   10.524489] init: - preinit -
[   11.267385] mtk_soc_eth 1e100000.ethernet eth0: configuring for fixed/rgmii link mode
[   11.275716] mtk_soc_eth 1e100000.ethernet eth0: Link is Up - 1Gbps/Full - flow control rx/tx
[   11.284205] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   11.465484] do_page_fault(): sending SIGSEGV to jshn for invalid read access from 77ed7063
[   11.473760] epc = 00401cac in jshn[400000+2000]
[   11.478304] ra  = 00401314 in jshn[400000+2000]
Segmentation fault
[   11.570275] do_page_fault(): sending SIGSEGV to jshn for invalid read access from 77e36063
[   11.578546] epc = 00401cac in jshn[400000+2000]
[   11.583090] ra  = 00401314 in jshn[400000+2000]
Segmentation fault
[   11.635798] do_page_fault(): sending SIGSEGV to jshn for invalid read access from 77ea3063
[   11.644067] epc = 00401cac in jshn[400000+2000]
[   11.648628] ra  = 00401314 in jshn[400000+2000]
Segmentation fault
[   11.704442] do_page_fault(): sending SIGSEGV to jshn for invalid read access from 77e31063
[   11.712721] epc = 00401cac in jshn[400000+2000]
[   11.717264] ra  = 00401314 in jshn[400000+2000]
Segmentation fault
[   11.915857] do_page_fault(): sending SIGSEGV to grep for invalid read access from 77edb063
[   11.924141] epc = 0041bf9c in grep[400000+1d000]
[   11.928767] ra  = 00402bc4 in grep[400000+1d000]
Segmentation fault
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   15.137358] UBIFS (ubi0:2): Mounting in unauthenticated mode
[   15.143420] UBIFS (ubi0:2): background thread "ubifs_bgt0_2" started, PID 589
[   15.240841] UBIFS (ubi0:2): recovery needed
[   15.299133] random: procd: uninitialized urandom read (4 bytes read)
[   15.418612] UBIFS (ubi0:2): recovery completed
[   15.423204] UBIFS (ubi0:2): UBIFS: mounted UBI device 0, volume 2, name "rootfs_data"
[   15.431018] UBIFS (ubi0:2): LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
[   15.440908] UBIFS (ubi0:2): FS size: 46346240 bytes (44 MiB, 365 LEBs), journal size 2285568 bytes (2 MiB, 18 LEBs)
[   15.451307] UBIFS (ubi0:2): reserved for root: 2189047 bytes (2137 KiB)
[   15.457910] UBIFS (ubi0:2): media format: w4/r0 (latest is w5/r0), UUID 14DCE125-9CBD-451F-997E-BBBB07C4AE24, small LPT model
[   15.473312] mount_root: switching to ubifs overlay
[   15.481356] do_page_fault(): sending SIGSEGV to modprobe for invalid read access from 77e9a063
[   15.489973] epc = 0040254c in kmodloader[400000+3000]
[   15.495036] ra  = 00401444 in kmodloader[400000+3000]
[   15.502793] overlayfs: upper fs does not support xattr, falling back to index=off and metacopy=off.
[   15.517243] urandom-seed: Seed file not found (/etc/urandom.seed)
[   15.597519] do_page_fault(): sending SIGSEGV to uci for invalid read access from 77ec2063
[   15.605704] epc = 004021ac in uci[400000+3000]
[   15.610158] ra  = 00400fc4 in uci[400000+3000]
Segmentation fault
[   15.623542] procd: - early -
[   15.626646] procd: - watchdog -
[   16.256311] procd: - watchdog -
[   16.259803] procd: - ubus -
[   16.382209] random: ubusd: uninitialized urandom read (4 bytes read)
[   16.393788] random: ubusd: uninitialized urandom read (4 bytes read)
[   16.400585] random: ubusd: uninitialized urandom read (4 bytes read)
[   16.410616] procd: - init -
Please press Enter to activate this console.
[   16.674567] do_page_fault(): sending SIGSEGV to find for invalid read access from 77e90063
[   16.682869] epc = 00427d9c in findutils-find[400000+29000]
[   16.688371] ra  = 00402754 in findutils-find[400000+29000]
[   16.856998] do_page_fault(): sending SIGSEGV to jshn for invalid read access from 77e8a063
[   16.865307] epc = 00401cac in jshn[400000+2000]
[   16.869871] ra  = 00401314 in jshn[400000+2000]
[   17.023336] do_page_fault(): sending SIGSEGV to grep for invalid read access from 77ef7063
[   17.031609] epc = 0041bf9c in grep[400000+1d000]
[   17.036241] ra  = 00402bc4 in grep[400000+1d000]
[   17.045120] do_page_fault(): sending SIGSEGV to kmodloader for invalid read access from 77e8c063
[   17.053911] epc = 0040254c in kmodloader[400000+3000]
[   17.058973] ra  = 00401444 in kmodloader[400000+3000]
[   18.152760] do_page_fault(): sending SIGSEGV to jshn for invalid read access from 77e24063
[   18.161069] epc = 00401cac in jshn[400000+2000]
[   18.165629] ra  = 00401314 in jshn[400000+2000]
[   18.258731] do_page_fault(): sending SIGSEGV to jshn for invalid read access from 77e2b063
[   18.266998] epc = 00401cac in jshn[400000+2000]
[   18.271544] ra  = 00401314 in jshn[400000+2000]
[   18.324613] do_page_fault(): sending SIGSEGV to jshn for invalid read access from 77e83063
[   18.332896] epc = 00401cac in jshn[400000+2000]
[   18.337441] ra  = 00401314 in jshn[400000+2000]
[   18.393696] do_page_fault(): sending SIGSEGV to jshn for invalid read access from 77ea9063
[   18.401963] epc = 00401cac in jshn[400000+2000]
[   18.406508] ra  = 00401314 in jshn[400000+2000]
[   18.596401] do_page_fault(): sending SIGSEGV to uci for invalid read access from 77e90063
[   18.604587] epc = 004021ac in uci[400000+3000]
[   18.609045] ra  = 00400fc4 in uci[400000+3000]
[   20.876425] __do_page_fault: 88 callbacks suppressed
[   20.876439] do_page_fault(): sending SIGSEGV to fw3 for invalid read access from 77eed063
[   20.889559] epc = 00411acc in fw3[400000+13000]
[   20.894118] ra  = 00402bb4 in fw3[400000+13000]
[   20.930997] do_page_fault(): sending SIGSEGV to validate_data for invalid read access from 77e1c063
[   20.940044] epc = 00400f6c in validate_data[400000+2000]
[   20.945371] ra  = 004009b4 in validate_data[400000+2000]
[   20.956609] do_page_fault(): sending SIGSEGV to validate_data for invalid read access from 77e47063
[   20.965649] epc = 00400f6c in validate_data[400000+2000]
[   20.970971] ra  = 004009b4 in validate_data[400000+2000]
[   20.982130] do_page_fault(): sending SIGSEGV to validate_data for invalid read access from 77ee8063
[   20.991180] epc = 00400f6c in validate_data[400000+2000]
[   20.996505] ra  = 004009b4 in validate_data[400000+2000]
[   21.007552] do_page_fault(): sending SIGSEGV to validate_data for invalid read access from 77e32063
[   21.016628] epc = 00400f6c in validate_data[400000+2000]
[   21.021956] ra  = 004009b4 in validate_data[400000+2000]
[   21.037596] do_page_fault(): sending SIGSEGV to jshn for invalid read access from 77e7c063
[   21.045888] epc = 00401cac in jshn[400000+2000]
[   21.050431] ra  = 00401314 in jshn[400000+2000]
[   21.213703] do_page_fault(): sending SIGSEGV to uci for invalid read access from 77eb8063
[   21.221895] epc = 004021ac in uci[400000+3000]
[   21.226351] ra  = 00400fc4 in uci[400000+3000]
[   21.238426] do_page_fault(): sending SIGSEGV to uci for invalid read access from 77e7b063
[   21.246615] epc = 004021ac in uci[400000+3000]
[   21.251071] ra  = 00400fc4 in uci[400000+3000]
[   21.263280] do_page_fault(): sending SIGSEGV to uci for invalid read access from 77e1e063
[   21.271469] epc = 004021ac in uci[400000+3000]
[   21.275928] ra  = 00400fc4 in uci[400000+3000]
[   21.307424] do_page_fault(): sending SIGSEGV to uci for invalid read access from 77e01063
[   21.315619] epc = 004021ac in uci[400000+3000]
[   21.320075] ra  = 00400fc4 in uci[400000+3000]
[   22.405759] random: crng init done
[   22.409172] random: 6 urandom warning(s) missed due to ratelimiting
[   39.964147] usb_vbus: disabling

ajw107 · June 9, 2020, 5:00pm

I've moved this to the installing sub forum, as not sure it's really a development forum thing. Any help greatly appreciated.

ajw107 · June 10, 2020, 11:35am

Is anyone able to help, I'm still unable to recover the router. Any help would be great, or should I move this question to another forum area?

ajw107 · June 11, 2020, 2:57pm

Going to answer my own question here. Got it working there were a few things to fix:

the router info page https://openwrt.org/toh/xiaomi/xiaomi_r3p_pro is not very clear on a few things, especially when using a serial connection. You must:

DO NOT connect Vcc this will break your UART dongle
A symptom of this is not being able to send commands, whilst seeing the console output and the boot wait not working for the boot menu (another symptom is the dongle just dying completely)
You don't strictly need to, but when you are installing OpenWRT for the first time, or just afterwards, it's a good idea to set:
- fw_setenv uart_en 1 (or nvram setenv uart_en 1 from stock firmware)
- fw_setenv boot_wait on (or nvram setenv boot_wait on from stock firmware)
- fw_setenv boot_time 5 (or nvram setenv boot_time 5 from stock firmware)

If your /etc/config/network file is corrupt, use kitty (better than putty) to upload this:


config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config interface 'lan'
	option type 'bridge'
	option ifname 'eth0.1'
	option proto 'static'
	option ipaddr '192.168.1.1'
	option netmask '255.255.255.0'
	option ip6assign '60'

config device 'lan_eth0_1_dev'
	option name 'eth0.1'
	option macaddr 'ec:41:18:eb:94:f0'

config interface 'wan'
	option ifname 'eth0.2'
	option proto 'dhcp'

config interface 'wan6'
	option ifname 'eth0.2'
	option proto 'dhcpv6'

config switch
	option name 'switch0'
	option reset '1'
	option enable_vlan '1'

config switch_vlan
	option device 'switch0'
	option vlan '1'
	option ports '1 2 3 6t'

config switch_vlan
	option device 'switch0'
	option vlan '2'
	option ports '4 6t'

by nano /etc/config/network
right click on the kitty title bar and select Send Script File
browse to where you saved the above config file
exit nano ctrl+x
execute service network restart
set your PC's ethernet to 192.168.1.2 netmask 255.255.255.0
use winscp to upload a RELEASE VERSION of OpenWRT
- if you get an error failed to connect to ubus execute firstboot and select Y (you may get more errors) then reboot with reboot -f and repeat the above steps
The OpenWRT webpage should eventually be viewable on 192.168.1.1 (remember to reset your PC's Ethernet adapter to it's default setting after you've finished).

If you find that when you try and log in to the OpenWRT Webpage on Chrome it doesn;t do anything (literally, no error message, just returns you right back to the log in page) press F12 then select Clear Storage then click on Clear Site Data and try again.

Phew, hope this all helps someone else. I'll try and update the router info page when I've got chance, and can work out how to do it.

system · June 21, 2020, 2:57pm

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.