Xiaomi Wifi Router 3G - 18.06.X / feedback and help

Hi @after,
I encountered the same issue.
Has this random reboot problem been solved?

[ 1727.771750] Unhandled kernel unaligned access[#1]:
[ 1727.781300] CPU: 3 PID: 70 Comm: kworker/3:1 Not tainted 4.14.105 #0
[ 1727.794041] Workqueue: events_long nf_ct_kill_acct [nf_conntrack]
[ 1727.794061] task: 8fd80c80 task.stack: 8fd08000
[ 1727.794066] $ 0   : 00000000 00000001 00000000 00022ba7
[ 1727.794083] $ 4   : 8e6025d8 00000000 3c8a8035 00000001
[ 1727.794098] $ 8   : 00000000 00007c00 00000192 0021c0de
[ 1727.794113] $12   : 00000000 00000000 3b9aca00 00000000
[ 1727.794127] $16   : 8e6025d8 8e494700 8e494700 fffffff0
[ 1727.794145] $20   : 00000000 00000604 80580000 00000003
[ 1727.794165] $24   : 27739c00 8e4c06bc
[ 1727.794186] $28   : 8fd08000 8fd09db8 8e4d0000 8e600650
[ 1727.794210] Hi    : 0000001d
[ 1727.794215] Lo    : 74955000
[ 1727.794242] epc   : 8e600658 nf_ct_nat_ext_add+0x218/0x928 [nf_nat]
[ 1727.794261] ra    : 8e600650 nf_ct_nat_ext_add+0x210/0x928 [nf_nat]
[ 1727.794266] Status: 11007c03 KERNEL EXL IE
[ 1727.794283] Cause : 40800014 (ExcCode 05)
[ 1727.794287] BadVA : 00022ba7
[ 1727.794291] PrId  : 0001992f (MIPS 1004Kc)
[ 1727.794294] Modules linked in: pppoe ppp_async pppox ppp_generic nf_conntrack_ipv6 mt76x2e mt76x2_common mt76x02_lib mt76 mac80211 iptable_nat ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_socket xt_recent xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_iprange xt_hl xt_helper xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_TPROXY xt_TCPMSS xt_REDIRECT xt_LOG xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CT xt_CLASSIFY slhc nf_socket_ipv6 nf_socket_ipv4 nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_nat nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack_netlink nf_conntrack libcrc32c iptable_raw iptable_mangle iptable_filter ipt_ECN ip6table_raw
[ 1727.794503]  ip_tables crc_ccitt compat fuse tcp_bbr sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_tcindex cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred ledtrig_usbport xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 ifb vfat fat nls_utf8 nls_iso8859_1 nls_cp437 mmc_block mtk_sd mmc_core leds_gpio xhci_plat_hcd xhci_pci xhci_mtk xhci_hcd ahci libahci libata sd_mod scsi_mod gpio_button_hotplug ext4 mbcache
[ 1727.794745]  jbd2 usbcore nls_base usb_common crc32c_generic
[ 1727.794778] Process kworker/3:1 (pid: 70, threadinfo=8fd08000, task=8fd80c80, tls=00000000)
[ 1727.794783] Stack : fffffff0 00000000 00000604 80580000 8e494700 8e4cfdc8 8e4cfdd8 8e4caeb8
[ 1727.794819]         8fc2b300 00000000 05600003 8e494700 8e494700 8e494710 00000007 8e4c066c
[ 1727.794856]         8f6cd924 8fd36100 8123fa00 00000001 8e494700 8e4c1c48 8123e380 8008ad90
[ 1727.794882]         8fd80fa0 80470000 8f6cd94c 8059ce20 8e4d0000 8e4d0000 00000020 00000000
[ 1727.794905]         8e4cfd64 8e4ccad4 81242700 00000000 8e4cfd64 8fd36100 8123fa00 81242900
[ 1727.794939]         ...
[ 1727.794963] Call Trace:
[ 1727.794983] [<8e600658>] nf_ct_nat_ext_add+0x218/0x928 [nf_nat]
[ 1727.795049] Code: 02002025  8e23007c  8e220078 <ac620000> 10400002  00000000  ac430004  24020200  ae22007c
[ 1727.795090]
[ 1727.795199] ---[ end trace 46ae1a2b6c1a5eb2 ]---
[ 1727.806443] Kernel panic - not syncing: Fatal exception in interrupt
[ 1728.445305] Rebooting in 3 seconds..

you have access in ssh?


I received the router a few days ago, flashed padavan with prometheus, and wanted to switch to OpenWRT/LEDE with the breed bootloader, so i installed breed. Well, apparently the install wasn't successful and now the router starts, but has a constant violet led and doesnt react to anything.
I tried accessing it over Serial with the TX/RX, and this ist what i receive:

Boot and Recovery Environment for Embedded Devices
Copyright (C) 2018 HackPascal <hackpascal@gmail.com>
Build date 2018-12-29 [git-135bed9]
Version 1.1 (r1266)

Bootloader data is corrupted!

System halted.


I can't access the serial console, so, is there any way to fix it? i searched a lot, i also looked tat the 4pda forum with autotranslate, found two similar cases, but there wasn't a fix mentioned, except maybe the NOR (SPI_pamyat) memory.
Can somebody help me figure out how to fix it?

I figured out that it was because of the breed-bootloader, after I switched back to the original one the messages disappeared!

original message:
I am getting "compare signature failed" messages in kernel.log. Anything I need to worry about or is it meaningless?

[    2.684424] 10 fixed-partitions partitions found on MTD device MT7621-NAND
[    2.691280] Creating 10 MTD partitions on "MT7621-NAND":
[    2.696593] 0x000000000000-0x000000080000 : "Bootloader"
[    2.702994] 0x000000080000-0x0000000c0000 : "Config"
[    2.708970] 0x0000000c0000-0x000000100000 : "Bdata"
[    2.714835] 0x000000100000-0x000000140000 : "Factory"
[    2.720928] 0x000000140000-0x000000180000 : "crash"
[    2.726815] 0x000000180000-0x0000001c0000 : "crash_syslog"
[    2.733312] 0x0000001c0000-0x000000200000 : "reserved0"
[    2.739593] 0x000000200000-0x000000600000 : "kernel_stock"
[    2.746167] 0x000000600000-0x000000a00000 : "kernel"
[    2.752160] 0x000000a00000-0x000007f80000 : "ubi"
[    2.758845] [mtk_nand] probe successfully!
[    2.763086] compare signature failed ffc0
[    2.767235] compare signature failed ff80
[    2.771362] compare signature failed ff40
[    2.775486] compare signature failed ff00
[    2.779632] compare signature failed fec0
[    2.783759] compare signature failed fe80
[    2.787899] compare signature failed fe40
[    2.792026] compare signature failed fe00
[    2.796177] compare signature failed fdc0
[    2.800304] compare signature failed fd80
[    2.804428] compare signature failed fd40
[    2.808569] compare signature failed fd00
[    2.812695] compare signature failed fcc0
[    2.816841] compare signature failed fc80
[    2.820968] compare signature failed fc40
[    2.825092] compare signature failed fc00
[    2.829233] compare signature failed fbc0
[    2.833359] compare signature failed fb80
[    2.837505] compare signature failed fb40
[    2.841632] compare signature failed fb00
[    2.845773] compare signature failed fac0
[    2.849899] compare signature failed fa80
[    2.854023] compare signature failed fa40
[    2.858171] compare signature failed fa00
[    2.862299] compare signature failed f9c0
[    2.866439] compare signature failed f980
[    2.870565] compare signature failed f940
[    2.874689] compare signature failed f900
[    2.878835] compare signature failed f8c0
[    2.882962] compare signature failed f880
[    2.887103] compare signature failed f840
[    2.891229] compare signature failed f800
[    2.895212] load_fact_bbt failed

18.06.02 flashed successfully with the manual from the other thread/wiki.
2.4GHz WLAN as Client Mode works.
5GHz WLAN as Client Mode does not work. It keeps disconnecting because of:

Kernel Log

[ 1621.818052] wlan1: authenticate with a4:93:3f:72:8b:26
[ 1622.539192] wlan1: send auth to a4:93:3f:72:8b:26 (try 1/3)
[ 1622.545819] wlan1: authenticated
[ 1622.556607] wlan1: associate with a4:93:3f:72:8b:26 (try 1/3)
[ 1622.563590] wlan1: RX AssocResp from a4:93:3f:72:8b:26 (capab=0x1011 status=0 aid=1)
[ 1622.571547] wlan1: associated
[ 1622.656357] wlan1: Limiting TX power to 23 (23 - 0) dBm as advertised by a4:93:3f:72:8b:26
[ 1630.589526] wlan1: deauthenticated from a4:93:3f:72:8b:26 (Reason: 15=4WAY_HANDSHAKE_TIMEOUT)

Someone got an idea what i could try? Password is correct and same channel and bandwidth.

Probably the only way is to flash memory with external flasher. Of corse You have Your full memory backup?

It is very annoying that the Mi Router 3G's integrated switch lacks support for igmp snooping.
When using it as a switch to bridge from one LAN-port to the other, it has problems with an IPTV multicast stream using igmp v3. The GUI reacts slow and the load increases to almost one.

According to [SOLVED] IGMP Snooping on Switch Ports the mt7530 chip or driver seems to lack the igmp snooping feature.

swconfig list
Found: switch0 - mt7530

Just bridge separate VLANs in software, and IGMP snooping will work just fine. I used it as a workaround for my mt7621 device as well.

True, good workaround.
Create 2 additional vlans, e.g. 92 for lan2 and 93 for wan. Add cpu as tagged and for 92 lan2 as untagged (93: wan untagged). After that save and reboot. Then add the two new vlans 91 and 92 to the br-lan and you are fine.
I had to reboot because otherwise I could not at them to br-lan as they were not listed.

I have a backup of the entire flash memory of another router of the same Modell. Would that work? And what kind of external flasher would be required? I am a newbie when it's comes to actual external flashing

@Double-G can you share your network config, I did add new vlan but it seems problem still happen

Hello Pataha,

I had the situation that I needed to reboot after the vlan creation to properly add it to the lan-(bridge)interface.
In my setup I assigned all three ports to the lan-bridge as I do not use wan or any routing. In my setup the mi router 3g is just a layer2 accesspoint and switch.
So what I changed is:

  • vlan 1: untagged on port lan1, tagged on cpu (unchanged), port lan 2 removed.
  • crate vlan 92 and 93.
  • vlan 92: untagged on port lan 2, tagged on cpu.
  • vlan 93: untagged on port wan, tagged on cpu.

Interface-Config for LAN:
Physical settings:
add interfaces eth0.92 and eth0.93.

The load on the system does not jump to 1 anymore, it stay at 0.6-0.7 even during high performance transfers and the GUI does not get sluggish anymore in such a situation. No packetloss.

@Double-G thanks for the helps, mine extract the same
did you use igmpproxy? if yes can you show the config /etc/config/igmpproxy and interfaces /etc/config/network
btw, Im on the latest snapshot of openwrt, what your version?

All I did happened on 18.06.2 and was:

  1. enable igmp snooping on lan:
config interface 'lan'
        option igmp_snooping '1'
  1. Force the device to use v3.

[reboot for changes to take effect or adust /proc/sys/...]

I do not use igmpproxy because the device acts as layer2 switch and not as layer3 router (no wan, therefor no need for NAT on this device; got another router running).

Hello i just got openwrt to the mi-r3g and having the console still open through serial when i enter the Network->Switch page on lua i get on the serial console "[ 845.943960] vlan egress tag control neither untag nor tag."

I guess i could just not enter this page, but why is this showing?. As far as i have read the tags should be correct the way they are. Should i just leave it pooping once a second or not? Keep in mind that on WAN i have a PPPoE connection.

Looking forward to your help

EDIT: I just updated to version OpenWrt SNAPSHOT r9872-78ee6b1 using this guys builds (https://github.com/trinhpham/xiaomi-r3g-openwrt-builder) and it still does the same thing, also another problem i noticed with the old version (18.06.2) is it used to lose the connection of the eth0.2 (WAN) like the cable was unplugging even though it didn't. If it happens again with the new version i will post the kernel log

That is the error i get on eth0 port 1

[149950.255822] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[149954.586320] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[154388.921779] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[154391.856544] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[164918.437441] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[164921.393096] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[168469.278361] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[168473.685745] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[172292.360527] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[172295.413567] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[174671.762404] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[174674.709324] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[176803.793065] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[176808.217369] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[179844.493125] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[179847.460304] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[182516.201282] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[182519.085041] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[184419.974992] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[184424.132905] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[186531.165718] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[186534.150947] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up
[189784.402322] mtk_soc_eth 1e100000.ethernet eth0: port 1 link down
[189787.264979] mtk_soc_eth 1e100000.ethernet eth0: port 1 link up\

i tried changing the cable but the same happens

2 posts were merged into an existing topic: Xiaomi Wifi Router 3G - 18.06.x / Wifi issues 2.4GHz + 5GHz


just as a short notice. I had the bootloop issue, too. I recovered with serial connection and TFTP but not by going over stock but rather by directly flashing openwrt-18.06.2-ramips-mt7621-mir3g-initramfs-kernel.bin


I am currently running a custom build I compiled using the master-repository. I was wondering wether I can flash the 18.06.2 sysupgrade.tar file from luci to downgrade the system??

The current master sysupgrades are sysupgrade.BIN files while the 18.06.x are sysupgrade.TAR files.

So, is it save to flash a "tar" in an "bin"-environment?


My suggestion would be to flash the latest 18.06 snapshot.
It includes LUCI and has more up to date drivers. Flash the sysupgrade.tar file.

1 Like

Does anyone have problems upgrading OpenWRT 18.06.2 to a new snapshot release?

"root@OpenWrt-AP:/tmp# sysupgrade -v /tmp/openwrt-ramips-mt7621-xiaomi_mir3g-squashfs-sysupgrade.bin
Invalid sysupgrade file.
Image check 'platform_check_image' failed."

I can see there's are difference in filenames, the new snapshot now contains "xiaomi_mir3g" where as the previous versions always were "mir3g".

Can I safely use -F (force) or should I flash the kernel/rootfs as if it's a new install?