Xiaomi WiFi Router 3G


Console access is only through UART now. There should be a developer firmware later as usual, that will make ssh access available.


Thanks @dissent1, looks very promising.

Could you please share what are the next steps required to flash LEDE using UART ?
Assuming I already compiled LEDE from sources (including your commit for mir3g), disassembled the router, soldered the UART connector and connected to PC using UART to USB cable.


Installation steps are described in that PR:)

  • copy lede-ramips-mt7621-mir3g-squashfs-kernel1.bin and lede-ramips-mt7621-mir3g-squashfs-rootfs0.bin to usb disk
  • switch to /extdisks/sda1/
  • run: mtd write lede-ramips-mt7621-mir3g-squashfs-kernel1.bin kernel1
  • run: mtd write lede-ramips-mt7621-mir3g-squashfs-rootfs0.bin rootfs0
  • run: mtd erase kernel0
  • run: reboot


@dissent1 I am looking into your PR and I am wondering what did you do to kernel0 partition.
In DTS there is comment that you deleted kernel0 partition and renamed it to kernel_erase but it looks like you did not erase the whole partition since the original kernel0 partition ends in 0x600000 and you have deleted it until 0x400000


In DTS I've just renamed kernel0 into kernel_erase for others to o remind that it should be erased with 'mtd erase kernel0' while on stock firmware.
0x400000 is the size of the partition, not an end address


Thanks,that makes sense


Excellent! thank you very much @dissent1, to conclude - all I need to do is connect to UART using USB to UART, connect USB stick with the compiled files and with serial access program, putty for example I can start typing the commands.

Some other questions:

  1. Is there any special soldering need to be made (shorcut) to get UART configuration?

  2. I find in google the following pads layout, please correct me if I'm wrong: PAD 1(next to dot): CS, 2:MISO, 3: WP, 4:GND, 5:MOSI, 6:SCK, 7:HOLD, 8:VCC.

  3. Is there any limitation on the UART to USB cable? or do I need USB to UART TTL cable? I do have a very cheap "CH340T CH340G USB to ESP8266 Serial Wifi Module Development Board Adapter", which I bought in the past for ESP8266 development, is it expected to work?


You dont need serial access at all.
You can do it over SSH


Yes, when the router has booted completely.
As for your other questions considering uart soldering - I have no clue, I've found a guy that had uart attached already. My unit is still on its way from China :slight_smile:

Unfortunately there's no dev firmware yet


I forgot that by default stock fw disables uart, so u have to interrupt u-boot booting and run
setenv uart_en 1


I tried SSH as it https://wiki.openwrt.org/toh/xiaomi/mini but router does NOT enabled SSH. :confused:
Probably due no developer rom in it.


Without Developer ROM you cant get SSH access


@dissent1 is it possible for you to get the soldering instructions from that guy and share? I understand there is no spec which defines the SPI flash pads and each company may choose its own layout.

Also, could you please share the instructions to interrupt u-boot ?


He tells that uart pins are labeled on the board with according output gnd, rx, tx. He used a ttl cable, but he attached it through a programmer he already had.


Thanks @dissent1, I got confused because of the Chinese translation for the spiflash pads and understand my mistake now.
There is a UART connector (J4) on the top of the image (see image below) next to the MI logo:
It has 4 pins, I assume pin #1 (left) is for VCC, pins #2-4 are labeled as RX, GND and TX respectively.

Regarding the u-boot interrupt, I understand UART is not enabled by default, so I'm not sure I understand where do I type the commands (which you shared) or how to interrupt u-boot in order to enable UART and type these commands

setenv uart_en 1

Could you please share some clarification on this ?


There's a prompt

Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP.

You should push 4


The dev firmware seem to be out


Please note that I have not been able to test the dev firmware as my device is still en route from china so there could be a reason why it has been removed...
It was available shortly at http://www.miwifi.com/miwifi_download.html but now it seems like they have removed the link. It's available at http://bigota.miwifi.com/xiaoqiang/rom/r3g/miwifi_r3g_firmware_c2175_2.25.122.bin (I was able to reconstruct the link as I downloaded the firmware two days ago so a had the filename).


I think they added the link back.
My device did not arrive yet and I did not test the dev fw.

Are there any advantages for using the dev fw over soldering uart? (except for the soldering part ...).

It appears to me the flow to enable ssh using the dev fw is very complicated and requires flashing at least 2 different fws before we can flash lede.


You don’t need to erase kernel0, issueing these commands from stock fw is enough (taking into account that you have flashed kernel1 and rootfs0)
nvram set flag_last_success=1
nvram commit