I have Xiaomi WiFi Router 3G V2. It has not usb port.
I really need OpenWRT for this but I don't know how to make a custom firmware....
Can anyone please help?
Thanks all
Hi there,
open up the case, solder a serial pin header (2.51 pitch on 3G V1) and post the full bootlog of your device.
Probably it's almost the same as the first xiaomi wifi router 3g apart from missing usb, probably other nand flash and or dram chip...
If this is true you can first try to boot the initram image from version 1 per tftp without flashing anything and verify what works and what doesn't work.
Greets
How to get bootlog dispense use serial pin ?
Firstly you need a pin header like here:
https://openwrt.org/toh/xiaomi/mir3g#serial
Secondly you need a usb serial adapter with ttl logic like this:
And lastly a computer with usb and a serial terminal like putty:
https://putty.org/
Edit: Don't forget the cables to connect the two pin headers of your router and serial adapter.
Firstly you need a pin header like here:
https://openwrt.org/toh/xiaomi/mir3g#serial
I don't access this page
Just got the router as it was sold to me as a "3G".
Apparently Xiaomi did cut corners and this is a rebranded "4A Gigabit Edition" and there's some advanced discussion about it here: Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit): fully supported but requires overwriting SPI flash with programmer So basically there's no openwrt yet.
The manufacture date on mine is "06.2019" so I assume it's unsafe to buy the 3G from china now. Be careful what you buy!
Edit: Managed to get a 50% refund from AliExpress, so don't be afraid to open a dispute!
3 Likes
Same here. I ordered on chinabrands.com. Where did you order?
Also note that there is already a patch submitted, so probably most of the work has already been done: https://patchwork.ozlabs.org/patch/1146511/
1 Like
Got mine from Aliexpress, seller had the description for the v1 and I paid 38€ for it, received a v2, opened a dispute and got 11€ back so not too bad tbh.
Waiting for my SPI flash programmer to arrive, in the mean time merged the available patch to my local repository and built a few images.
Still not too sure why they market both models if they are exact clones.
1 Like
Alright. I am still hoping to get a 3G model somewhere, because it looks pretty decent and is easy to flash.
1 Like
From what I've seen most sellers have raised the price for the v1 model due to demand and availability.
===================================================================
MT7621 stage1 code Oct 28 2018 20:39:32 (ASIC)
CPU=500000000 HZ BUS=166666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL3 FB_DL: 0x0, 1/0 = 1024/0 01000000
PLL4 FB_DL: 0xd, 1/0 = 586/438 35000000
PLL2 FB_DL: 0xe, 1/0 = 534/490 39000000
do DDR setting..[01F40000]
Apply DDR3 Setting...(use customer AC)
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120
--------------------------------------------------------------------------------
0000:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0001:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0002:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0003:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0004:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0005:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0006:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0007:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0008:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0009:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
000D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1
000E:| 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1
000F:| 0 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0
0010:| 1 1 1 1 1 1 1 1 1 0 0 0 0 0 0 0
0011:| 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0
0012:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0013:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0014:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0015:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0016:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0017:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0018:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0019:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001A:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001B:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001C:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001D:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001E:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
001F:| 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
DRAMC_DQSCTL1[0e0]=13000000
DRAMC_DQSGCTL[124]=80000033
rank 0 coarse = 15
rank 0 fine = 72
B:| 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0
opt_dle value:10
DRAMC_DDR2CTL[07c]=C287222D
DRAMC_PADCTL4[0e4]=000022B3
DRAMC_DQIDLY1[210]=0E0D0A0B
DRAMC_DQIDLY2[214]=06090B0A
DRAMC_DQIDLY3[218]=0C090808
DRAMC_DQIDLY4[21c]=0B090B09
DRAMC_R0DELDLY[018]=00001F21
==================================================================
RX DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 9 6 10 11 7 8 7 6 7 8
10 | 9 10 8 11 9 10
--------------------------------------
==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =33 DQS1 = 31
==================================================================
bit DQS0 bit DQS1
0 (1~62)31 8 (2~59)30
1 (1~57)29 9 (1~62)31
2 (1~60)30 10 (1~62)31
3 (1~60)30 11 (1~58)29
4 (1~60)30 12 (1~59)30
5 (1~60)30 13 (1~61)31
6 (1~62)31 14 (1~62)31
7 (1~65)33 15 (1~60)30
==================================================================
3.dq delay value last
==================================================================
bit| 0 1 2 3 4 5 6 7 8 9
--------------------------------------
0 | 11 10 13 14 10 11 9 6 8 8
10 | 9 12 9 11 9 11
==================================================================
==================================================================
TX perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15, finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15, finish count=2
DQ loop=15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=15, finish count=1
dqs_perbyte_dly.last_dqdly_pass[1]=15, finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:88
[EMI] DRAMC calibration passed
===================================================================
MT7621 stage1 code done
CPU=500000000 HZ BUS=166666666 HZ
===================================================================
U-Boot 1.1.3 (Apr 8 2019 - 13:34:42)
Board: Ralink APSoC DRAM: 128 MB
Power on memory test. Memory size= 128 MB...OK!
relocate_code Pointer at: 87fb0000
Config XHCI 40M PLL
RT2880_RSTSTAT_REG 0xc0030000
***************************
Board power on Occurred
***************************
flash manufacture id: c8, device id 40 18
find flash: GD25Q128C
============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: SPI Flash
Date:Apr 8 2019 Time:13:34:42
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 880 MHZ ####
estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN LLLLW
restore_defaults:0
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.
n3: System Boot system code via Flash.
Booting System 1
Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
.
done
## Booting image at bc180000 ...
Image Name: MIPS OpenWrt Linux-3.10.14
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1855708 Bytes = 1.8 MB
Load Address: 81001000
Entry Point: 813ecce0
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
.
done
commandline uart_en=0 factory_mode=0 mem=128m root=/dev/mtdblock9
No initrd
## Transferring control to Linux (at address 813ecce0) ...
## Giving linux memsize in MB, 128
1 Like
Got my SPI programmer today and have got my R3Gv2 on Openwrt and working perfectly.
Let's hope the patches make their way into offical builds.
Thx
Could you please share me a programmer firmware with Openwrt? Thx in advance.
1 Like
These are what I've compiled and used.
From stock Xiaomi firmware send the initramfs-kernel.bin over TFTP and once it's rebooted and Openwrt's running, flash the sysupgrade.bin with LUCI or CLI.
https://drive.google.com/open?id=1VafI6QbULi5tM8siIFj0uucBRNhiAd-A
2 Likes
Thx a lot for your help 
1 Like
A post was split to a new topic: Where to buy Xiaomi WiFi Router 3G v1
how to send nitramfs-kernel.bin over TFTP ?
You can stop the boot progress and access the boot menu?
please show me how to do?
1 Like