Xiaomi mi wifi 3 support

hi

X-wrt is for Ordinary users, and the advanced menu that brings confusion is hidden. If you need to display the advanced menu, as an advanced user, you can execute the command rm /etc/adv_luci_disabled via ssh so that you can display the hidden menu.

1 Like

thank you...
i would suggests adding an AP mode to the initial setup part ...
ive been trying to disable firewall ,dnsmasq etc but they keep starting at the startup...

Hello.
I was trying to restore NAND flash via SPI and special pre-builded U-boot(with NAND driver).
Screenshot_2019-04-19_01-26-32
Now what I getted.
After command:
nand init
It shows NAND page size and other number.
Ater that, if I put command:
nand id
It shows real ID of my NAND flash:
flash id: 1 f1 0 1d

When i try to read some data from NAND via command:
nand read 0 0x100
It tells me that all sectors are bad, even more if I try to read more than 0x100 - It tells me that whole selected sectors are bad.
I.e. that U-boot driver says that on my NAND-flash no any live sectors.
It is possible?

Sorry I was gone for such a long time, hectic few weeks coupled with my poor time management skills.
I hope to return to the conversation over the next week or so.

1 Like

hi, I got the same.
could you please tell me what you did to recovery the mi3.
I'am really new here.
many thanks

hi, did you fix it?

Hi,

I would also love if someone would explain to flash maybe a good new breed-bootloader. I guess we could take the xiaomi mi mini-breed-bootloader of here: https://breed.hackpascal.net/

It would hopefully bring our device to a non-destroyable level (at least with firmware-flashing playing around)...

Here is an instruction which should also work for MI3 since I guess it's the same hardware like MI Mini.

https://sites.google.com/view/mirouterminipadavan/instructions

But the more important question is if there are already improvements for RAMIPS in 5 GHz under OpenWRT. It seems the development stucks still in a very basic state even when there are already patches and solutions to improve the support for all RAMIPS (MT7620A, MT7610e, MT...)

What is the performance doing on 5 GHz wifi in x-wrt? - Can you already flash x-wrt with an included breed? -That would be amazing! I am on an old openwrt version and would give x-wrt a try since I flashed it already on an Archer C20i, but unfortunately they cut opkg out, so you're stuck with their packages included. But it was impressive what they pushed into the 8 MB flash of C20i. There was OpenVPN, WWAN3 and Samba included for the USB-support.

Actually, they had never removed OPKG, only the LuCi module.
You can use it via SSH, and then install the module to have it in LuCi as well.

Hi:
I bricked my r3 router. I flashed Pandora successfully at first. When i wanted to revert to stock, I made some mistake with the procedure(in other webpage). So I linked the TTL cable. Successfully flashed Padarvan inside with option "2". But it will hang as log shows. So now option "2" and "9" are not possible. It will reset automatically when I choose those two options. Only option "1" is possible. But tftp kernel0 will not make sense. So I'm not sure about the next step. Is purchase an 16MB flash and mounted on board the only way? Any other solution?

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2019.05.25 00:41:06 =~=~=~=~=~=~=~=~=~=~=~=
 妽犨達____________________________________________________________ 

鼱牋犨達_                 _                 ____               |

|   |牋郀軤哌 _ _ __   __| | ___  _ __ __ _| __ )  _____  __   |

|   | |_) 癄哙狘牕_ \ / _` |/ _ \| '__/ _` |  _ \ / _ \ \/ /   |

|   |  __/ (_| |狘狘狘?_| | (_) | | | (_| | |_) | (_) >  <    |

|   |_|   \__,_|_| |_哌黒___/|_|  \__,_|____/ \___/_/\_\   |

|                         牋牋牋牋                             |

|                PandoraBox Ral轭氙驮藸Platform                |

|                   The Core of Smart绎豸弪?                  |

|                Copyright 2017 PandoraBox犜遽頎?             |

|______________________________________________哌哌哌達________|


PandoraBox-Boot Version 2.1

Build:Nov  8 2018-08:备罕箠嵱oC:MT7620A 

Memory-Testing...131072K OK

MT7620:CPU clock set to 580Mhz

PCIe:reset controlle驃嵭颅嘛雉 running at 0x87FA8000!

NAND: F59L1G81MA 128MiB

Using internal default config

Board:Xiaomi R3

PandoraBox GPIO subsystem init

PandoraBox犕苑恫?GPIO driver initialized.

GPIO_Mode_REG: 0x0012391C

PandoraBox犔拍狊鮞system init

LED [Power] registered

PandoraBox Button subsyste頎轭轸妽Button [Reset] registered

MT762X GSW initialized

 0 

Booting from Flash...

Booting image犳蝻頎忏200000 ...

牋 Image Name:   MI-3

   Image Type:   MIPS Linux Kernel Image (禚磲犮镯pressed)

   Data Size:    14795272 Bytes = 14.1 MB

   Load Add蝈篌籂?000000

   Entry Point:  802fb000

ranand_read: skip reading a bad block 4800鞍牠緺碼0000

nfc_ecc_verify mode:read瑺轭鲠靑d ecc, page: 940 read:0 0 0, ecc:56aa6a 

nfc_ecc_verify mode:r遽洮犻顅alid ecc2, page: 940 read:0 0 0, ecc2:330fc3 

nfc_ecc_verify m镤搴蝈醖, invalid ecc3, page: 940 read:0 0 0, ecc3:9a69a9 

nfc_ecc_ver殒鶢盹溴:read, invalid ecc4, page: 940 read:0 0 0, ecc4:659656 

nfc_ecc喏弪殒?mode:read, invalid ecc, page: 940 read:0 0 0, ecc:56aa6a 

nfc_邈氵鲥騣fy mode:read, invalid ecc2, page: 940 read:0 0 0, ecc2:330fc3 
嶎驺咤鉩_verify mode:read, invalid ecc3, page: 940 read:0 0 0, ecc3:9a6贯範妽铈c_ecc_verify mode:read, invalid ecc4, page: 940 read:0 0 0, ecc4憾倒兜?

nfc_ecc_verify mode:read, invalid ecc, page: 940 read:0 0 0, 邈愫刀醓6a 

nfc_ecc_verify mode:read, invalid ecc2, page: 940 read:0 0牥瑺邈?:330fc3 

nfc_ecc_verify mode:read, invalid ecc3, page: 940 rea浜盃盃艾 ecc3:9a69a9 

nfc_ecc_verify mode:read, invalid ecc4, page: 940狉遽浜?0 0, ecc4:659656 

trying to do correction!

correction : 0 0 0妽泔蝌錭tion : 6a ffffffaa 56

xor = 56aa6a (0 56aa6a)

1. correct byte牭俺瑺鈏t 0!

correction : 0 0 0

correction : ffffffc3 f 33

xor = 330驺碃ò牫30fc3)

failed to correct!

nfc_read_page: fail, buf:87b865f8, p徵搴勾? 

read again:

nfc_ecc_verify mode:read, in鲠扉錉邈c, page: 940 read:0 0 0, ecc:56aa6a 

nfc_ecc_verify mode:read, 轭鲠扉?ecc2, page: 940 read:0 0 0, ecc2:330fc3 

nfc_ecc_verify mode:r遽洮犻顅alid ecc3, page: 940 read:0 0 0, ecc3:9a69a9 

nfc_ecc_verify m镤搴蝈醖, invalid ecc4, page: 940 read:0 0 0, ecc4:659656 

nfc_ecc_ver殒鶢盹溴:read, invalid ecc, page: 940 read:0 0 0, ecc:56aa6a 

nfc_ecc_v弪殒鶢韔de:read, invalid ecc2, page: 940 read:0 0 0, ecc2:330fc3 

nfc_邈氵鲥騣fy mode:read, invalid ecc3, page: 940 read:0 0 0, ecc3:9a69a9 
嶎驺咤鉩_verify mode:read, invalid ecc4, page: 940 read:0 0 0, ecc4:659兜稜妽铈c_ecc_verify mode:read, invalid ecc, page: 940 read:0 0 0, ecc:5夺岫釥?nfc_ecc_verify mode:read, invalid ecc2, page: 940 read:0 0 0, e沣埠吵癴c3 

nfc_ecc_verify mode:read, invalid ecc3, page: 940 read:0 0牥瑺邈?:9a69a9 

nfc_ecc_verify mode:read, invalid ecc4, page: 940 rea浜盃盃艾 ecc4:659656 

trying to do correction!

correction : 0 0 0

cor蝈泗轱?: 6a ffffffaa 56

xor = 56aa6a (0 56aa6a)

1. correct byte 503,犫轸牥?
correction : 0 0 0

correction : ffffffc3 f 33

xor = 330fc3 (盃吵版?)

failed to correct!

nfc_read_page: fail, buf:87b865f8, page:勾艾爦嶒ead again fail 

ranand_read: skip reading a bad block 4a0000 ->牬惆鞍?
牋犞erifying Checksum ... OK

   Uncompressing Kern屐犐磲鏴 ... OK
崰牋旗鮯hing cache from 0x80000000 size 3925864 ... OK
崓娞INUX started...
Linux version 3.4.113 (padavan@hms) (gcc version 4.4.7 (GCC) ) #12 Mon Apr 16 00:53:01 CST 2018

MediaTek SoC: MT7620A, RevID: 0206, RAM: DDR2, XTAL: 20MHz
CPU/OCP/SYS frequency: 600/200/200 MHz
CPU revision is: 00019650 (MIPS 24KEc)
Determined physical RAM map:
 memory: 08000000 @ 00000000 (usable)
Zone PFN ranges:
  Normal   0x00000000 -> 0x00008000
Movable zone start PFN for each node
Early memory PFN ranges
    0: 0x00000000 -> 0x00008000
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
Kernel command line: console=ttyS0,115200n8 root=/dev/mtdblock4 rootfstype=squashfs
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Writing ErrCtl register=0006ca4e
Readback ErrCtl register=0006ca4e
Memory: 125980k/131072k available (3083k kernel code, 5092k reserved, 573k data, 180k init, 0k highmem)
NR_IRQS:40
console [ttyS0] enabled
Calibrating delay loop... 397.82 BogoMIPS (lpj=795648)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 246
io scheduler noop registered
io scheduler bfq registered (default)
BFQ I/O-scheduler version: v7r7
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x10000c00 (irq = 20) is a 16550A
Ralink GPIO driver initialized. Number of GPIO: 73, GPIO mode: 00101B1D
loop: module loaded
!!! nand page size=2048, addr len=4
Creating 9 MTD partitions on "ra_nfc":
0x000000000000-0x000000040000 : "Bootloader"
0x000000040000-0x0000000c0000 : "BootEnv"
0x0000000c0000-0x000000600000 : "Factory"
nand_block_checkbad: offs:480000 tag: BAD 
nand_block_checkbad: offs:4a0000 tag: BAD 
0x000000600000-0x00000864006e : "Kernel"
mtd: partition "Kernel" extends beyond the end of device "ra_nfc" -- size truncated to 0x7a00000
0x000008000000-0x000000fbff92 : "RootFS"
mtd: partition "RootFS" is out of reach -- disabled
0x000000000000-0x000000080000 : "Config"
0x000000080000-0x000005080000 : "Storage"
nand_block_checkbad: offs:480000 tag: BAD 
nand_block_checkbad: offs:4a0000 tag: BAD 
0x000005080000-0x000006a00000 : "RWFS"
0x000000600000-0x000001600000 : "Firmware_Stub"
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
Ralink APSoC Ethernet Driver v3.2.4 (raeth)
raeth: PDMA RX ring 256, PDMA TX ring 512. Max packet size 1536
raeth: NAPI support, weight 32
raeth: Byte Queue Limits (BQL) support
PPP generic driver version 2.4.2
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPTP driver version 0.8.5
usbcore: registered new interface driver libusual
nf_conntrack version 0.5.0 (16384 buckets, 32768 max)
xt_time: kernel timezone is -0000
Bridge firewalling registered
gre: GRE over IPv4 demultiplexor driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
8021q: 802.1Q VLAN Support v1.8
ASUS NVRAM, v0.08. Available space: 131072. Integrity: Signature FAILED!
end_request: I/O error, dev mtdblock4, sector 0
SQUASHFS error: squashfs_read_data failed to read block 0x0
SQUASHFS error: unable to read squashfs_super_block
VFS: Cannot open root device "mtdblock4" or unknown-block(31,4): error -5
Please append a correct "root=" boot option; here are the available partitions:
1f00             256 mtdblock0  (driver?)
1f01             512 mtdblock1  (driver?)
1f02            5376 mtdblock2  (driver?)
1f03          124928 mtdblock3  (driver?)
1f05             512 mtdblock5  (driver?)
1f06           81920 mtdblock6  (driver?)
1f07           26112 mtdblock7  (driver?)
1f08           16384 mtdblock8  (driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)

How could I recover if Pandora bootloader is abnormal? Before that, I flashed Padarvan (.trx) to nand via ttl directly. And then option "2" and "9" are no longer active. It will always cause system reset. Only option "1" is active now. But kernel0 could not recover Pandora.

I'm sorry, I can't help u guys anymore bcoz I don't have a physical device. My mir3 bricked like 6 months ago.

Following this post Xiaomi mi wifi 3 support

Can someone confirm if I got it correctly.
I want to switch from PandoraBox to OpenWRT.

  1. On PandoraBox flash lede-ramips-mt7620-miwifi-r3-squashfs-sysupgrade.bin, reboot
  2. Login to WebUI, set password, enable SSH
  3. Set nvram variables (most likely not needed second time?)
nvram set flag_last_success=1
nvram set boot_wait=on
nvram set uart_en=1
nvram commit
  1. Flash (images from mega/PandoraBox/Revert to Stock and mega/OpenWRT)
mtd write Bootloader.bin Bootloader
mtd write kernel0.bin kernel0_rsvd
mtd write openwrt-ramips-mt7620-xiaomi_miwifi-r3-squashfs-kernel1.bin kernel1
mtd write openwrt-ramips-mt7620-xiaomi_miwifi-r3-squashfs-rootfs0.bin rootfs0

Will this get me into working OpenWRT instance?

At last, I bringed up this bricked router.
I got a router with a BAD NAND memory (there were BAD, including on the Uboot section!)
I bought flash memory for a cents (already with some kind of firmware) on Ali.
Soldered instead of old chip, but it turns out that the memory with the SPI-mod (or clearly: with the driver) does not want to work!
Plus, to all, if you fix the driver for using SPI+NAND in parallel, there will be some weird things in the oob area in the new NAND memory - whole flash will be in BADs!

In short, unbrick:
I modified Padavan U-boot code for low-level erasing of NAND-memory - now all blocks are clean, including the oob area.
But since there is no possibility to flash NAND-memory from under Uboot (there is not fully implemented this method via SPI bootloader), then I had to modify the OpenWRT driver for SPI+NAND parallel work (I wrote it on NAND using the simply mtd utility).

Who interesting, I can tell in detail.
I.e. It is possible to flash NAND memory (even a new chip) without a programmer! Only with SPI-mod!
(no additional hardware: jumpers / resistors / soldering are needed SPI and NAND use are HW compatible , it needed only for Bootstarp, if you want to change the boot from SPI => NAND or backward)

2 Likes

Also interested in it. Can someone confirm it's working?
(just not sure why Step#1 is required)

Step no.1 is replacing system to OpenWRT.
So technically, it's the only one needed to get it working.

That means though we still have PandoraBox bootloader and maybe some other partitions as well.

In fact i've managed to switch to OpenWRT from Pandorabox using openwrt-ramips-mt7620-xiaomi_miwifi-r3-squashfs-pb-boot.bin, located inside the Mega archive.

Now via ssh i see "OpenWrt 18.06-SNAPSHOT, r7649-cf60098f88".
Everything works fine, 5G is stable...

1 Like

Hey Deoptim. Would you mind sharing your method in detail how you debrick your router? What kind of modded SPI or other tools needed?

Hey buddy. How did you fix this?

f**ck that wiki there my xiaomi got bricked
even if i try serial console can do the recovery damm!!! somebodyt change it now my xiaomi is all orange light