Try the method above, maybe not need serial console.
https://www.youtube.com/watch?v=VxzEvdDWU_s
1 Like
thank you, unfortunately this does not help in my case, the original firmware is not booting anymore. It's caught in a reboot loop. Don't know why though, shouldn't a firmware update completely erase flash memory and therefore restart from scratch?
Maybe I experienced a similar Situation, at least the LEDs acted the same but I don't have serial access.
Resetting the router by Holding the Button allowed me to enter Recovery Mode where I could erase configuration.
I've still seen success in the past with similar boot loops so it might be worth a try unless you have changed the Uboot it should still go into recovery. Also good to check when you do the debrick that the firmware is the same as was original with you device e.g if its English or Chinese versions.
What do you mean with "go into recovery"? The device establishes a tftp connection and download a firmware image. It gets flashed but it won't reboot sucessfully. Original firmware was english, however I only found the chinese images. Can I download an english firmware somewhere?
When I say "in to recovery" I mean when holding the reset while powering on the device it goes into what is know as "recovery mode" which is when it attempts to repair itself by grabbing a tftp image if one is avalible so sounds like that is working fine for you.
So definitely sounds like your issue is that you're trying to repair it with the "Global" (Chinese) not "International" (English) version, the two arent interchangable... Unfortunatly. Luckly for you someone has posted the international firmware here on the forum:
yes, then I get into recovery mode. However, it does not flash this image. I already tried it yesterday and UBoot said something like "Image too large" 
Where did you get that error? over serial or in tftp?
over serial
Just to confirm the file size you have is 14.1MB or there abouts?
the on my disk is 14.8M actually (14.824.352 bytes). sha256 is correct
Try this slightly older version:
https://hoddysguides.com/download/12292/
It's about 10MB which is less than the version I use for the global so hopefully should be ok, let me know if it works.
I make the checksum: 5a48bfaffd8ab16b4103f6eb49c850e6c11bf2eecc595fba709ba96cae28f33d
thx, will test in roughly one hour and post the result here!
1 Like
Nice, hopefully my upcoming release will increase even further.
Hi, what model do you have? its not clear?
Just so you know, the 3GV2, some models use u-boot and not breed loader and some only breed, very confusing situation that xiaomi have done.
Can you do a screen shot of your serial output so we can see the errors?
It didn't like this image:
Bytes transferred = 10486708 (a003b4 hex)
LoadAddr=82000000 NetBootFileXferSize= 00a003b4
Not R4A package.
Header check error!
Image verify failed!
========Upgrade fail!========
This is the output with the Chinese image (2.28.62)
===================================================================
MT7621 stage1 code Oct 28 2018 20:39:32 (ASIC)
CPU=500000000 HZ BUS=166666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL3 FB_DL: 0x9, 1/0 = 581/443 25000000
PLL4 FB_DL: 0xf, 1/0 = 570/454 3D000000
PLL2 FB_DL: 0x10, 1/0 = 725/299 41000000
do DDR setting..[01F40000]
Apply DDR3 Setting...(use customer AC)
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1
000E:| 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1
000F:| 0 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0
0010:| 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0
0011:| 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
DRAMC_DQSCTL1[0e0]=13000000
DRAMC_DQSGCTL[124]=80000033
rank 0 coarse = 15
rank 0 fine = 72
B:| 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0
opt_dle value:9
DRAMC_DDR2CTL[07c]=C287221D
DRAMC_PADCTL4[0e4]=000022B3
DRAMC_DQIDLY1[210]=0E0C0B0A
DRAMC_DQIDLY2[214]=07090A09
DRAMC_DQIDLY3[218]=0C090708
DRAMC_DQIDLY4[21c]=0B080C08
DRAMC_R0DELDLY[018]=00002122
==================================================================
RX DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 7 8 9 12 7 7 8 7 6 6
10 | 8 10 7 10 8 9
--------------------------------------
==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =34 DQS1 = 33
==================================================================
bit DQS0 bit DQS1
0 (1~62)31 8 (1~62)31
1 (0~62)31 9 (1~64)32
2 (1~62)31 10 (1~64)32
3 (1~64)32 11 (1~61)31
4 (1~64)32 12 (1~63)32
5 (1~62)31 13 (1~62)31
6 (1~65)33 14 (1~65)33
7 (1~67)34 15 (1~62)31
==================================================================
3.dq delay value last
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 10 11 12 14 9 10 9 7 8 7
10 | 9 12 8 12 8 11
==================================================================
==================================================================
TX perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15, finish count=2
DQ loop=15, cmp_err_1 = ffff0080
dqs_perbyte_dly.last_dqdly_pass[1]=15, finish count=1
DQ loop=14, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=14, finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:88
[EMI] DRAMC calibration passed
===================================================================
MT7621 stage1 code done
CPU=500000000 HZ BUS=166666666 HZ
===================================================================
U-Boot 1.1.3 (May 11 2020 - 10:41:20)
Board: Ralink APSoC DRAM: 128 MB
Power on memory test. Memory size= 128 MB...OK!
relocate_code Pointer at: 87fb0000
Config XHCI 40M PLL
RT2880_RSTSTAT_REG 0xc0030000
***************************
Board power on Occurred
***************************
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: SPI Flash
Date:May 11 2020 Time:10:41:20
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 880 MHZ ####
estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN LLLLW
restore_defaults:0
NetTxPacket = 0x87FE52C0
KSEG1ADDR(NetTxPacket) = 0xA7FE52C0
NetLoop,call eth_halt !
NetLoop,call eth_init !
Trying Eth0 (10/100-M)
Waitting for RX_DMA_BUSY status Start... done
ETH_STATE_ACTIVE!!
BOOTP broadcast 1
NetOurIP
NetOurIP
DHCPHandler: got packet: (src=67, dst=68, len=300) state: 3
Filtering pkt = 0
DHCPHandler: got DHCP packet: (src=67, dst=68, len=300) state: 3
DHCP: state=SELECTING bp_file: "recovery.bin"
TRANSITIONING TO REQUESTING STATE
*** Unhandled DHCP Option in OFFER/ACK: 28
Bootfile: recovery.bin
DhcpSendRequestPkt: Sending DHCPREQUEST
Transmitting DHCPREQUEST packet: len = 343
DHCPHandler: got packet: (src=67, dst=68, len=300) state: 4
Filtering pkt = 0
DHCPHandler: got DHCP packet: (src=67, dst=68, len=300) state: 4
DHCP State: REQUESTING
*** Unhandled DHCP Option in OFFER/ACK: 28
Bootfile: recovery.bin
DHCP client bound to address 192.168.0.211
TFTP from server 192.168.0.2; our IP address is 192.168.0.211
Filename 'recovery.bin'.
TIMEOUT_COUNT=10,Load address: 0x82000000
Loading: Got ARP REPLY, set server/gtwy eth addr (74:2b:62:87:55:c1)
Got it
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##################################Got ARP REQUEST, return our IP
###############################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
###########################################################checksum bad
######
####################################################checksum bad
#############
#############checksum bad
###############checksum bad
###############################checksum bad
######
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
############
done
Bytes transferred = 13370296 (cc03b8 hex)
LoadAddr=82000000 NetBootFileXferSize= 00cc03b8
CRC verify success!
RSA signature verify success!
Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
.
done
Offset[0]: Invalid flash address, skip upgrade...
Upgrade firmware.bin...
Start=0x180000, Len=0xcc0004...
raspi_erase_write: offs:180000, count:cc0004
raspi_erase: offs:180000 len:cc0000
ok, so didnt answer my first question, but looking at your logs you must have the mi 4a model.
So, the built in u-boot bootloader, can reflash the chinese firmware, by turning off the router, then hold down the reset button, keep it held down then power it on. This will make it go into bootp mode. Your bootloader is fine, so the rest can be figured out if there is an issue with your NOR chip the 16m that stores the firmware.
Could you capture this from your serial console like you have with this. Just want to see what errors you are getting, then can advise next steps.
You can use another tool called tinypxe if you are on windows or use my docker dhcp tool on linux (might work on windows or mac?) which has the firmware and to put this router back to oem mode.
Yes, it's a "Mi Router 4A Gigabit Edition"
that's what I did to produce this log. It's actually downloading the chinese image from my computer via tftp and the bootp configuration is done by dnsmasq