Mi WiFi 3 is the new low cost 802.11ac WiFi router by Xiaomi that sells for about $40. GearBest send my one sample for evaluation, and today, I’ve taken some photo of the device and board, and connected the UART pin to see if the serial console was accessible for people who want to try to port OpenWrt for example.
Xiaomi Mi WiFi 3 Unboxing
There’s some information on the package, but everything is in Chinese, except the part about AC1200 meaning it supports up to 867 Mbps with 802.11ac and 300 Mbps using 802.11n.
The router comes with a 12V/1A power supply, and a user’s manual in Chinese only. There’s also a QR code inside the box linking to the Android and iOS apps, available both in English and Chinese, so actually that one of the few Xiaomi product that should be easy to use outside of China without some hacks.
The router has four external antennas.
The rear panel features a reset pinhole, a USB port to connect storage, two LAN ports, one WAN port, and the DC jack.
Xiaomi Mi WiFi 3 Router Teardown
First it looks like I only had to pop the bottom of the case with some plastic tool, but then I noticed a screw in the middle was holding it together. So I had to pierce through the sticker with my screwdriver to completely open it.
I was a bit surprised that they had used such as large enclosure for a small board, but maybe marketing is in play here with bigger is better? [Update: Actually, it’s for the router to avoid falling backward due to the weight of the antennas]
Beside the three GLGNET GSD16002LF 100Mbit magnetics, the main components include Mediatek MT7612EN 802.11a/b/g/n/ac Wi-Fi 2T2R chip, a chip under a small heatsink which must be MT7620A, and NANYA NT5TU64M16HG-AC DDR2 chip (64 MB). You’ll also notice the pin for the serial console are clearly marked on the right side, but more on that below. The two 5GHz antennas are on left, and the two 2.4GHz antennas on the right in the picture above.
The bottom of the board features Spansion S34ML01G100TF100 flash with 128 MB capacity.
Xiaomi MiWiFi 3 Serial Console
I’ve also soldered a 4-pin header on the right side of the board (GND, Tx, Rx, and 3.3V). to check if I could indeed access the serial console with a USB to TTL debugger adapter.
Then I started minicom with the usual settings (115200 8N1), powered up the board, and I could get the serial log:
Compiled on Jan 1 2014, 17:13:19.
Port /dev/ttyUSB0, 16:21:43Press CTRL-A Z for help on special keys
U-Boot 1.1.3 (Mar 16 2016 – 14:15:12)
Board: Ralink APSoC DRAM: 128 MB
Power on memory test. Memory size= 128 MB…OK!
relocate_code Pointer at: 87fb8000
enable ephy clock…done. rf reg 29 = 5
SSC disabled.
!!! nand page size = 2048, addr len=4
..============================================
Ralink UBoot Version: 4.2.S.1
——————————————–
ASIC 7620_MP (Port5None)
DRAM_CONF_FROM: Auto-detection
DRAM_TYPE: DDR2
DRAM component: 1024 Mbits
DRAM bus: 16 bit
Total memory: 128 MBytes
Flash component: NAND Flash
Date:Mar 16 2016 Time:14:15:12
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 580 MHZ ####
estimate memory size =128 Mbytes
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.
3: System Boot system code via Flash.
Booting System 1
..Erasing NAND Flash…
Writing to NAND Flash…
done
## Booting image at bc200000 …
Image Name: MIPS OpenWrt Linux-2.6.36
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2616754 Bytes = 2.5 MB
Load Address: 80000000
Entry Point: 80000000
…………………………………. Verifying Checksum … OK
Uncompressing Kernel Image … OK
commandline uart_en=0 factory_mode=0 mem=128m
No initrd
## Transferring control to Linux (at address 80000000) …
## Giving linux memsize in MB, 128
Starting kernel …
LINUX started…
THIS IS ASIC
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 2.6.36 (jenkins@JenkinsServer) (gcc version 4.6.3 6
[ 0.000000]
[ 0.000000] The CPU feqenuce set to 580 MHz
[ 0.000000] PCIE: bypass PCIe DLL.
[ 0.000000] PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
[ 0.000000] disable all power about PCIe
[ 0.000000] CPU revision is: 00019650 (MIPS 24Kc)
[ 0.000000] Software DMA cache coherency
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty – disabling initrd
[ 0.000000] Zone PFN ranges:
[ 0.000000] Normal 0x00000000 -> 0x00008000
[ 0.000000] Movable zone start PFN for each node
[ 0.000000] early_node_map[1] active PFN ranges
[ 0.000000] 0: 0x00000000 -> 0x00008000
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pa2
[ 0.000000] Kernel command line: console=ttyS1,115200n8 root=/dev/ram0 uart_m
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bys
[ 0.000000] Writing ErrCtl register=0004a6ba
[ 0.000000] Readback ErrCtl register=0004a6ba
[ 0.000000] allocated 655360 bytes of page_cgroup
[ 0.000000] please try ‘cgroup_disable=memory’ option if you don’t want memos
[ 0.000000] Memory: 123440k/131072k available (3347k kernel code, 7632k rese)
[ 0.000000] SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, N1
[ 0.000000] NR_IRQS:128
[ 0.000000] console [ttyS1] enabled
[ 0.010000] Calibrating delay loop… 385.84 BogoMIPS (lpj=1929216)
[ 0.220000] pid_max: default: 32768 minimum: 301
[ 0.220000] Mount-cache hash table entries: 512
[ 0.220000] Initializing cgroup subsys cpuacct
[ 0.230000] Initializing cgroup subsys memory
[ 0.230000] Initializing cgroup subsys net_cls
[ 0.230000] devtmpfs: initialized
[ 0.240000] NET: Registered protocol family 16
[ 0.240000] RALINK_GPIOMODE = 121b1c
[ 0.240000] RALINK_GPIOMODE = 101b1c
[ 0.440000] PPLL_CFG1=0xe44000
[ 0.450000] MT7620 PPLL lock
[ 0.450000] PPLL_DRV =0x80080504
[ 0.650000] Deassert the PCIE0 RESET.
[ 0.650000] start PCIe register access
[ 1.150000] RALINK_RSTCTRL = 2400000
[ 1.160000] RALINK_CLKCFG1 = 75afffc0
[ 1.160000]
[ 1.160000] *************** MT7620 PCIe RC mode *************
[ 1.660000] PCIE0 enabled
[ 1.670000] init_rt2880pci done
[ 1.670000] bio: create slab at 0
[ 1.680000] SCSI subsystem initialized
[ 1.680000] usbcore: registered new interface driver usbfs
[ 1.680000] usbcore: registered new interface driver hub
[ 1.690000] usbcore: registered new device driver usb
[ 1.690000] pci 0000:00:00.0: BAR 0: can’t assign mem (size 0x80000000)
[ 1.700000] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[ 1.700000] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pre]
[ 1.710000] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[ 1.710000] pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI]
[ 1.720000] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64b]
[ 1.720000] pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff 64bit]
[ 1.730000] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pre]
[ 1.730000] pci 0000:00:00.0: PCI bridge to [bus 01-01]
[ 1.740000] pci 0000:00:00.0: bridge window [io disabled]
[ 1.740000] pci 0000:00:00.0: bridge window [mem 0x20000000-0x200fffff]
[ 1.750000] pci 0000:00:00.0: bridge window [mem 0x20100000-0x201fffff pre]
[ 1.750000] BAR0 at slot 0 = 0
[ 1.760000] bus=0x0, slot = 0x0
[ 1.760000] res[0]->start = 0
[ 1.760000] res[0]->end = 0
[ 1.760000] res[1]->start = 20200000
[ 1.770000] res[1]->end = 2020ffff
[ 1.770000] res[2]->start = 0
[ 1.770000] res[2]->end = 0
[ 1.770000] res[3]->start = 0
[ 1.780000] res[3]->end = 0
[ 1.780000] res[4]->start = 0
[ 1.780000] res[4]->end = 0
[ 1.780000] res[5]->start = 0
[ 1.790000] res[5]->end = 0
[ 1.790000] bus=0x1, slot = 0x0
[ 1.790000] res[0]->start = 20000000
[ 1.790000] res[0]->end = 200fffff
[ 1.800000] res[1]->start = 0
[ 1.800000] res[1]->end = 0
[ 1.800000] res[2]->start = 0
[ 1.800000] res[2]->end = 0
[ 1.810000] res[3]->start = 0
[ 1.810000] res[3]->end = 0
[ 1.810000] res[4]->start = 0
[ 1.810000] res[4]->end = 0
[ 1.820000] res[5]->start = 0
[ 1.820000] res[5]->end = 0
[ 1.820000] Switching to clocksource MIPS
[ 1.830000] NET: Registered protocol family 2
[ 1.830000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 1.840000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[ 1.850000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[ 1.850000] TCP: Hash tables configured (established 4096 bind 4096)
[ 1.860000] TCP reno registered
[ 1.860000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 1.870000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 1.870000] NET: Registered protocol family 1
[ 3.280000] RT3xxx EHCI/OHCI init.
[ 3.290000] msgmni has been set to 241
[ 3.290000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major )
[ 3.300000] io scheduler noop registered (default)
[ 3.310000] RALINK_REG_PIO7140DATA b0000670 = 0
[ 3.410000] RALINK_REG_PIO7140DATA b0000670 = 2000000
[ 3.420000] Ralink gpio driver initialized
[ 3.420000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 3.430000] serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
[ 3.430000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
[ 3.440000] init reset module!
[ 3.450000] brd: module loaded
[ 3.450000] !!! nand page size = 2048, addr len=4
[ 3.460000] ra_nand_init: alloc 1350, at 87d90000 , btt(87d910c0, 100), ranf0
[ 3.470000] Creating 13 MTD partitions on “ra_nfc”:
[ 3.470000] 0x000000000000-0x000008000000 : “ALL”
[ 3.500000] 0x000000000000-0x000000040000 : “Bootloader”
[ 3.510000] 0x000000040000-0x000000080000 : “Config”
[ 3.510000] 0x000000080000-0x0000000c0000 : “Bdata”
[ 3.520000] 0x0000000c0000-0x000000100000 : “Factory”
[ 3.530000] 0x000000100000-0x000000140000 : “crash”
[ 3.530000] 0x000000140000-0x000000180000 : “crash_syslog”
[ 3.540000] 0x000000180000-0x000000200000 : “reserved0”
[ 3.540000] 0x000000200000-0x000000600000 : “kernel0”
[ 3.550000] 0x000000600000-0x000000a00000 : “kernel1”
[ 3.560000] 0x000000a00000-0x000002a00000 : “rootfs0”
[ 3.560000] 0x000002a00000-0x000004a00000 : “rootfs1”
[ 3.570000] 0x000004a00000-0x000008000000 : “overlay”
[ 3.570000] rdm_major = 253
[ 3.580000] SMACCR1 — : 0x0000f0b4
[ 3.580000] SMACCR0 — : 0x2985a41d
[ 3.580000] Ralink APSoC Ethernet Driver Initilization. v3.0 256 rx/tx desc!
[ 3.590000] SMACCR1 — : 0x0000f0b4
[ 3.600000] SMACCR0 — : 0x2985a41d
[ 3.600000] PROC INIT OK!
[ 3.610000] PPP generic driver version 2.4.2
[ 3.610000] PPP MPPE Compression module registered
[ 3.620000] NET: Registered protocol family 24
[ 3.620000] PPTP driver version 0.8.5
[ 3.630000] ehci_hcd: USB 2.0 ‘Enhanced’ Host Controller (EHCI) Driver
[ 3.750000] rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
[ 3.760000] rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus nu1
[ 3.800000] rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
[ 3.820000] rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
[ 3.820000] hub 1-0:1.0: USB hub found
[ 3.830000] hub 1-0:1.0: 1 port detected
[ 3.830000] ohci_hcd: USB 1.1 ‘Open’ Host Controller (OHCI) Driver
[ 3.860000] rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
[ 3.860000] rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus nu2
[ 3.870000] rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
[ 3.940000] hub 2-0:1.0: USB hub found
[ 3.940000] hub 2-0:1.0: 1 port detected
[ 3.950000] usbcore: registered new interface driver cdc_acm
[ 3.950000] cdc_acm: v0.26:USB Abstract Control Model driver for USB modems s
[ 3.960000] Initializing USB Mass Storage driver…
[ 3.970000] usbcore: registered new interface driver usb-storage
[ 3.970000] USB Mass Storage support registered.
[ 3.980000] usbcore: registered new interface driver usbserial
[ 3.980000] USB Serial support registered for generic
[ 3.990000] usbcore: registered new interface driver usbserial_generic
[ 4.000000] usbserial: USB Serial Driver core
[ 4.000000] USB Serial support registered for pl2303
[ 4.010000] usbcore: registered new interface driver pl2303
[ 4.010000] pl2303: Prolific PL2303 USB to serial adaptor driver
[ 4.020000] USB Serial support registered for TI USB 3410 1 port adapter
[ 4.030000] USB Serial support registered for TI USB 5052 2 port adapter
[ 4.030000] usbcore: registered new interface driver ti_usb_3410_5052
[ 4.040000] ti_usb_3410_5052: v0.10:TI USB 3410/5052 Serial Driver
[ 4.050000] Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_ma)
[ 4.050000] u32 classifier
[ 4.060000] input device check on
[ 4.060000] Actions configured
[ 4.060000] Netfilter messages via NETLINK v0.30 with ipset netlink.patch.
[ 4.070000] nf_conntrack version 0.5.0 (1928 buckets, 7712 max)
[ 4.080000] xt_time: kernel timezone is -0000
[ 4.080000] GRE over IPv4 demultiplexor driver
[ 4.090000] ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Coe
[ 4.100000] TCP cubic registered
[ 4.100000] NET: Registered protocol family 10
[ 4.110000] NET: Registered protocol family 17
[ 4.110000] L2TP core driver, V2.0
[ 4.110000] PPPoL2TP kernel driver, V2.0
[ 4.120000] L2TP netlink interface
[ 4.120000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[ 4.130000] All bugs added by David S. Miller <davem@redhat.com>
[ 4.150000] Freeing unused kernel memory: 1188k freed
[ 4.240000] Loading essential drivers…
[ 4.250000] Press Ctrl+C to enter RAMFS…
[ 5.260000] Check for USB recovery…
[ 5.290000] Bringup the system…
[ 5.300000] flag_boot_rootfs=0 mounting /dev/mtd10
[ 5.310000] UBI: attaching mtd10 to ubi0
[ 5.310000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 5.320000] UBI: logical eraseblock size: 126976 bytes
[ 5.320000] UBI: smallest flash I/O unit: 2048
[ 5.330000] UBI: VID header offset: 2048 (aligned 2048)
[ 5.340000] UBI: data offset: 4096
[ 5.490000] UBI: max. sequence number: 2
[ 5.500000] UBI: attached mtd10 to ubi0
[ 5.500000] UBI: MTD device name: “rootfs0”
[ 5.510000] UBI: MTD device size: 32 MiB
[ 5.510000] UBI: number of good PEBs: 256
[ 5.520000] UBI: number of bad PEBs: 0
[ 5.520000] UBI: max. allowed volumes: 128
[ 5.530000] UBI: wear-leveling threshold: 4096
[ 5.530000] UBI: number of internal volumes: 1
[ 5.540000] UBI: number of user volumes: 1
[ 5.540000] UBI: available PEBs: 0
[ 5.550000] UBI: total number of reserved PEBs: 256
[ 5.550000] UBI: number of PEBs reserved for bad PEB handling: 4
[ 5.560000] UBI: max/mean erase counter: 1/0
[ 5.560000] UBI: image sequence number: 1026081047
[ 5.570000] UBI: background thread “ubi_bgt0d” started, PID 80
UBI device number 0, total 256 LEBs (32505856 bytes, 31.0 MiB), available 0 LEB)
[ 5.660000] UBIFS: mounted UBI device 0, volume 0, name “system”
[ 5.660000] UBIFS: mounted read-only
[ 5.670000] UBIFS: file system size: 30093312 bytes (29388 KiB, 28 MiB, 23)
[ 5.670000] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LE)
[ 5.680000] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 5.690000] UBIFS: default compressor: zlib
[ 5.690000] UBIFS: reserved for root: 0 bytes (0 KiB)
config core ‘version’
# ROM ver
option ROM ‘2.8.12’
# channel
option CHANNEL ‘release’
# hardware platform R1AC or R1N etc.
option HARDWARE ‘R3’
# CFE ver
option UBOOT ‘1.0.2’
# Linux Kernel ver
option LINUX ‘0.1.12’
# RAMFS ver
option RAMFS ‘0.1.12’
# SQUASHFS ver
option SQAFS ‘0.1.12’
# ROOTFS ver
option ROOTFS ‘0.1.12’
#build time
option BUILDTIME ‘Wed, 16 Mar 2016 14:13:36 +0800’
#build timestamp
option BUILDTS ‘1458108816’
#build git tag
option GTAG ‘commit 17f50389a144da43f3858d508d9de41885282406’
mount: mounting proc on /proc failed: Device or resource busy
mount: mounting sysfs on /sys failed: Device or resource busy
[ 6.460000] Raeth v3.0 (Tasklet,SkbRecycle)
[ 6.460000]
[ 6.460000] phy_tx_ring = 0x074c7000, tx_ring = 0xa74c7000
[ 6.460000]
[ 6.460000] phy_rx_ring0 = 0x07df0000, rx_ring0 = 0xa7df0000
[ 6.460000] SMACCR1 — : 0x0000f0b4
[ 6.460000] SMACCR0 — : 0x2985a41d
[ 6.490000] CDMA_CSG_CFG = 81000000
[ 6.490000] GDMA1_FWD_CFG = 20710000
– preinit –
Wed Mar 16 14:27:38 UTC 2016
– regular preinit –
[ 6.670000] UBI: attaching mtd12 to ubi1
[ 6.670000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 6.680000] UBI: logical eraseblock size: 126976 bytes
[ 6.680000] UBI: smallest flash I/O unit: 2048
[ 6.690000] UBI: VID header offset: 2048 (aligned 2048)
[ 6.690000] UBI: data offset: 4096
[ 6.940000] UBI: max. sequence number: 122
[ 6.960000] UBI: attached mtd12 to ubi1
[ 6.960000] UBI: MTD device name: “overlay”
[ 6.970000] UBI: MTD device size: 54 MiB
[ 6.970000] UBI: number of good PEBs: 432
[ 6.980000] UBI: number of bad PEBs: 0
[ 6.980000] UBI: max. allowed volumes: 128
[ 6.990000] UBI: wear-leveling threshold: 4096
[ 6.990000] UBI: number of internal volumes: 1
[ 7.000000] UBI: number of user volumes: 1
[ 7.000000] UBI: available PEBs: 0
[ 7.000000] UBI: total number of reserved PEBs: 432
[ 7.010000] UBI: number of PEBs reserved for bad PEB handling: 8
[ 7.020000] UBI: max/mean erase counter: 1/0
[ 7.020000] UBI: image sequence number: 35629411
[ 7.030000] UBI: background thread “ubi_bgt1d” started, PID 149
UBI device number 1, total 432 LEBs (54853632 bytes, 52.3 MiB), available 0 LEB)
[ 7.080000] UBIFS: recovery needed
[ 7.130000] UBIFS: recovery completed
[ 7.130000] UBIFS: mounted UBI device 1, volume 0, name “data”
[ 7.140000] UBIFS: file system size: 52187136 bytes (50964 KiB, 49 MiB, 41)
[ 7.140000] UBIFS: journal size: 2666496 bytes (2604 KiB, 2 MiB, 21 LE)
[ 7.150000] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 7.160000] UBIFS: default compressor: lzo
[ 7.160000] UBIFS: reserved for root: 2464926 bytes (2407 KiB)
/lib/preinit.sh: line 1: jffs2_not_mounted: not found
– init –
[ 7.760000] ra2880stop()…Done
[ 7.780000] Free TX/RX Ring Memory!
init started: BusyBox v1.19.4 (2016-03-16 14:06:55 CST)
Please press Enter to activate this console. rcS S boot: INFO: rc script run ti.
[ 8.800000] tntfs: module license ‘Commercial. For support email ntfs-suppor.
[ 8.810000] Disabling lock debugging due to kernel taint
[ 8.850000] Tuxera NTFS driver 3015.1.29 [Flags: R/W MODULE].
[ 8.950000] Tuxera FAT 12/16/32 driver version 3014.1.24 [Flags: R/W MODULE].
[ 9.010000] tun: Universal TUN/TAP device driver, 1.6
[ 9.020000] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 9.040000] Mirror/redirect action on
[ 9.300000] GRE over IPv4 tunneling driver
[ 9.530000] ipt: xt_cgroup_MARK installed ok.
[ 9.600000] ip_set: protocol 6
[ 9.880000] sstack_init
[ 11.170000] [ 11.180000] [ 12.720000] [ 12.740000] CSRBaseAddress =0xc1100000, csr_addr=0xc1100000!
[ 12.750000] MAC_CSR0=1986146304, RtmpChipOpsHook
[ 12.760000] dev idx = 1!
[ 12.760000] get_dev_config_idx pAd->MACVersion = 76623000, pAd->ChipID4
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: INFO: loading exist /etc/config/ne.
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: #### Loopback configuration
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: config interface loopback
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ifname lo
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option proto static
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ipaddr 127.0.0.1
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option netmask 255.0.0.0
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: #### LAN configuration
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: config interface lan
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ifname eth0.1
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option type bridge
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option proto static
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ipaddr 192.168.31.1
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option netmask 255.255.255.0
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: #### WAN configuration
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: config interface wan
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ifname eth0.2
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option proto dhcp
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: ### IFB interface for MiQoS
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: config interface ifb
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ifname ifb0
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: #### READY configuration
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: config interface ready
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option proto static
Wed Mar 16 22:27:45 CST 2016 netconfig[405]: option ipaddr 169.254.29.1
Wed Mar 16 22:27:45 CST 2016 netconfig[405]: option netmask 255.255.255.0
[ 15.230000] Raeth v3.0 (Tasklet,SkbRecycle)
[ 15.230000]
[ 15.230000] phy_tx_ring = 0x05e6f000, tx_ring = 0xa5e6f000
[ 15.230000]
[ 15.230000] phy_rx_ring0 = 0x05e5d000, rx_ring0 = 0xa5e5d000
[ 15.230000] SMACCR1 — : 0x0000f0b4
[ 15.230000] SMACCR0 — : 0x2985a41d
[ 15.250000] CDMA_CSG_CFG = 81000000
[ 15.260000] GDMA1_FWD_CFG = 20710000
[ 15.280000] device eth0.1 entered promiscuous mode
[ 15.290000] device eth0 entered promiscuous mode
[ 15.310000] br-lan: port 1(eth0.1) entering learning state
[ 15.310000] br-lan: port 1(eth0.1) entering learning state
[ 16.020000] MAC_CSR0=1986146304, rtmp_asic_top_init
[ 16.150000] Set_Bsd_Proc 7114 Bsd 0
[ 17.310000] br-lan: port 1(eth0.1) entering forwarding state
[ 19.370000] <==== rt28xx_init, Status=0
[ 21.640000] device wl0 entered promiscuous mode
[ 21.640000] br-lan: port 2(wl0) entering learning state
[ 21.650000] br-lan: port 2(wl0) entering learning state
[ 22.250000] Set_Bsd_Proc 6786 Bsd 0
[ 23.650000] br-lan: port 2(wl0) entering forwarding state
For some reasons, I could not access the command line, as Rx did not seem to work. Not exactly sure why yet.
As mentioned in the introduction, GearBest sent the review sample, and you could purchase the router for $34.99 shipped from their website. The router is also sold for less than $40 on Aliexpress, GeekBuying, and probably other e-retailers.
Jean-Luc started CNX Software in 2010 as a part-time endeavor, before quitting his job as a software engineering manager, and starting to write daily news, and reviews full time later in 2011.
Support CNX Software! Donate via cryptocurrencies, become a Patron on Patreon, or purchase goods on Amazon or Aliexpress
Does this work as a range extender as well?
It doesn’t seem worth using this as a router if the wired connections are all 10/100, but it might be useful as a range extender from my existing AC router.
Also have you seen any mention of openwrt working on this?
Dont even buy it.. waste of money
@Phil Trickett
OpenWrt is working on the previous model: https://wiki.openwrt.org/toh/xiaomi/mini with similar specifications (Mediatek MT7620A + MT7612EN), except it has less memory and storage.
Now maybe I know why I can’t access the command line:
I’ve just played with the Android app, and after initial router setup, you’re being asked to sign-up for a Mi account? WTH?
Probably for cloud control?
Can you maybe contact manufacturer about flashing other firmware?
Could you please try both OpenWRT and DD-WRT on this router?
Would love to have it evaluated for both OpenWRT and DD-WRT.
I like seeing the antennas not soldered on…When will the Android box manufacturers start doing this?
Interesting little device. I’m somewhat afraid to purchase this given the utterly ancient kernel and the fact that it is relatively low on ram and flash. Still openwrt can do miracles with amounts like this. Do you know if the firmware is locked down? If this can be updated to a more recent release it would look like an interesting low-cost access point that can still process impressive bandwidth.
From the log messages it appears that the stock firmware is based on an older version of OpenWrt:
## Booting image at bc200000 …
Image Name: MIPS OpenWrt Linux-2.6.36
@cnxsoft
What the fuck? Is there a physical button for a factory reset that can revert this? I was just about to order one… :/
What’s the flash chip package? Is it socketed or soldered? I have a SOIC 8 clip and a ezp xpro that I could use to wipe everything except uboot or at least take a dump before it flips whatever bit it flips to kill off the tx…
Very sad 🙁
It appears that inability to access the command line is driven from a U-Boot parameter if the below line from the log is correct:
commandline uart_en=0 factory_mode=0 mem=128m
Setting uart_en=1 should result in access to the command line.
@Ray Knight
maybe hook a serial and stop at u-boot, change this uart_en to 1, then boot up will get Rx working?
“but maybe marketing is in play here with bigger is better?”
If the base was not sufficiently large enough, would not the weight of the four antennas as the rear tend to cause the base to much more readily tip backwards with only a very gentle slight touch?
That of course would not be a good thing and be very annoying to most people.
@Lieutenant Colonel Olivier South
Very good point, I did not think about it.
@RK
Maybe it’s possible to fix this by re-flashing the firmware: http://www1.miwifi.com/miwifi_download.html
There’s also a push button, but I’m not sure what it is for.
Interesting, they have two firmware for MiWiFi 3
* ROM for R3 稳定版 (stable version)
* ROM for R3 开发版 (developer edition)
Maybe developer edition means “beta” in that context, not sure. Otherwise, it could be easier to work with.
On previous models, Developer edition ROM means you can “root” (enable SSH access) the router.
@cnxsoft
Not sure about Xiaomi routers but usually to debrick a bricked router by holding down a semi-hidden reset-button inside a hole with a paperclip (and keep holding it down) while pressing the power-button to power. Or some kind of combination of pressing that reset-button inside a hole with a paperclip and plugging in the power-cable.
I would think that Xiaomi support should be able to tell you how to utilize that reset-button inside a hole with a paperclip to put the router into some kind of failsafe mode which will then enable you to flash the router with a new OpenWrt firmware without having to solder anything or even having to open it up at all.
https://wiki.openwrt.org/doc/howto/generic.debrick
@Lieutenant Colonel Olivier South
That could be one reason for the oversized casing, another reason could possibly be that they just reused an existing case casting mole for a other product?
Indeed, same process as the older 2 antennas version i have here.
Xiaomi definitely took lessons from apple / google as they require every user to register an account on their service to get full device support.
For that device it’s not entirely useless though, as doing so will let you get your “dev” firmware from their website which essentially gives you ssh/root access, you can then flash another openwrt firwmare if you wish to do so..
@xxiao
how do you change that value?
If you have a buspirate and a 2×4 SPI clamp, you could easily dump the flash chip, and maybe edit the value.
If you don’t have a buspirate, you could dump the SPI flash chip with a Raspberry Pi:
https://www.flashrom.org/RaspberryPi
@zoobab
See also here a good page about dumping an SPI flash chip with an Rpi:
https://github.com/bibanon/Coreboot-ThinkPads/wiki/Hardware-Flashing-with-Raspberry-Pi
For older model MiMini there is port from Asus N56. It named Padavan’s firmware and shipped as source due to Asus license limitation. But it could be easily could be compiled.
After reflashed to Padavan’s n56 MiMini became much more user friendly comparing to OpenWRT and more powerful that stock Xiaomi firmware.
So when Router3 will be included into device tree it will be good router.
Don’t mess with Xiaomi routers. There are MiYouth 64mb, MiMini 128mb, Router3, Router with HDD.
Hello,
He has repeater fonction. My wifi home from 2 to 4 bars 6 bars with walls to cross. I am surprised at this because I thought I saw he was not repeater. Good surprise. I do the setting with my PC by 192.168.31.1.
Hey guys,
Got this router in the mail finally. Thought I’d give it a shot and throw the mini version of openwrt on it. (Same chip, thought it couldn’t hurt)
I followed the same instructions but i couldn’t get the ssh patch to work on dev version 2.11.20. As I’m typing this Xiaomi just released a new rom for their stable build to 2.10.14. I will wait for them to update their website for a new version of their developer rom and retest.
Keep you guys posted wish me luck.
If anyone has got ssh to work on this router let me know.
@Lance D’Souza
Open SSH in a special way: http://www.right.com.cn/Forum/thread-185797-1-1.html
Passwords from page https://d.miwifi.com/rom/ssh?userId=… no value!
@Sport
That worked Sport! Now it seems there is a new obstacle to overcome.
As described in the OpenWRT install for the Xiaomi Mini,
cat /proc/mtd inorder to see if the partition OS1 exists.
No Dice…
Which partition should I install it in? Any suggestions?
Here is my SSH output
Lances-MacBook-Pro:~ lancedsouza$ ssh root@192.168.1.106
The authenticity of host ‘192.168.1.106 (192.168.1.106)’ can’t be established.
RSA key fingerprint is SHA256:FkHIAQOqTLZEdGjhOvFWUiZoQxHLysdubTsz/+lPkLg.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘192.168.1.106’ (RSA) to the list of known hosts.
root@192.168.1.106‘s password:
BusyBox v1.19.4 (2016-04-15 17:38:14 CST) built-in shell (ash)
Enter ‘help’ for a list of built-in commands.
—————————————————–
Welcome to XiaoQiang!
—————————————————–
root@XiaoQiang:~# cd /tmp/
root@XiaoQiang:/tmp# cat /proc/mtd
dev: size erasesize name
mtd0: 08000000 00020000 “ALL”
mtd1: 00040000 00020000 “Bootloader”
mtd2: 00040000 00020000 “Config”
mtd3: 00040000 00020000 “Bdata”
mtd4: 00040000 00020000 “Factory”
mtd5: 00040000 00020000 “crash”
mtd6: 00040000 00020000 “crash_syslog”
mtd7: 00080000 00020000 “reserved0”
mtd8: 00400000 00020000 “kernel0”
mtd9: 00400000 00020000 “kernel1”
mtd10: 02000000 00020000 “rootfs0”
mtd11: 02000000 00020000 “rootfs1”
mtd12: 03600000 00020000 “overlay”
root@XiaoQiang:/tmp#
Hi
Why can I not access my webserver (web settings) using the WAN IP address. Mi WiFi routers is connected after Mikrotik router and have WAN 192.168.88.217. Other routers working but Mi WiFi not. Is there any possibilites to enable this function on Mi WiFi.
Ok quick update.
Flashed the file to the kernel0 and on reboot router powered back on to Xiaomi’s Software.
Flashed the file to kernel1 and now router will not boot.
Sitting with a pretty brick.
Ok… This means at least you found the system Partition? Or am i wrong?
Because bootloader is in bootloader i guess… So i think you havnt destroyed that…
Have you dumped this Part? No respone while booting over console-Port?
Just a question. If the OS is based on OpenWrt (as some users have reported) is under GPL/GPL2. If I ask Xiaomi they have to release the OpenWRT source code used?
At this point will be quite easy to modify it to get ssh/root access or update to a newer OpenWRT release etc.
Hi everybody,
Is there any way to change the IP address of the mi WiFi Router 3 and also the DHCP range it is using?
Thanks and regards.
Use chrome to translate the whole site(Build in) then its easy to find the settings you are looking for….
I ordered mine from GB with the discount code for “GBXMW3” final price: $31.89
Is there a setting to turn the menus all in English?
(not the app, NOT with Google translate, Directly by router menu)
@Bloodyt
Can you tell me how to do it? I’m not seeing how.
@Gibbio
Yeah, if you didn’t have a horde of Indian users behind you, good luck with that. Not trying to be racist, but that’s the field’s fact. Xiaomi is a GPL offender. Maybe they will answer you, “Okay, we’ll release the source-code.” just so you shut up about it, and then didn’t release anything.
They’ll promise anything just for shutting up the crowd, and super rarely actually delivers that promise.
@Antonios
ATM no… no english included… but with chrome its very easy!
@njrbarros
open up your Chrome browser and open the Admin-Page of your router then right-click and translate to …
https://www.youtube.com/watch?v=20HpPt5XvnY
@Bloodyt
Thanks for your help.
Hi,
Thinking of getting one of these, anybody managed to get openwrt installed without bricking the device?
I see on this website some russians guys talking about putting some ASUS firmware on it:
http://4pda.ru/forum/index.php?showtopic=736801&st=20
and this video in russian:
https://www.youtube.com/watch?v=VQ35zI8W3ns&lc=z12wsrsi3r3mc51rk04ccrix2zecfvmrvxw0k
Thanks
@Jerome O’Flaherty
I’ve read OpenWrt developers mention that it’s a similar design to MiWiFi router, and the performance with OpenWrt is not very good due to some issue with the firmware (binary).
Does this router support WOL?
I bought 1, i am not that technical, but i got only 70 mbits. And my provider gives me 250 mbits, and i bought this because it is ac and has high speed, but it is bullcrap. How can you get ac speed with 10/100 wan and land ports? Is there any way to solder a gigabit port or some kind off mod for this router to speed some things up? And can anybody tell me how i could do it? Because i don’t know if there is a software restriction for being 10/100 port?
@Sero
70 Mbps (8.5MB/s) is not too bad actually for WiFi 802.11ac, but it depends how you measure it, and how far your device is from your router.
There’s no way to solder a Gigabit port. You could probably connect a USB Ethernet dongle which could reach 250 Mbps via USB 2.0, but I’m not sure the firmware supports it. In that case, you’d have to use alternative firmware, and configure it yourself…
I tested on laptop and note 4, my note 4 is capable of getting speeds like 350, i know it because i got that speed at my girlfriends router, but that one is a nighthawk netgear. I tested on both devices exactly sitting next to the router. I could try the usb thing i thaught about it but i was not sure that the usbport would allow it or would even give high speed. Do you think it is possible to get firmware on the device that could support the usb thing? But why couldn’t just unsolder the 10/100 port and mount a gigbit port instead? Does it need diffrent firmware to for this or will the board not support this?
@Sero
I have not tried it, but I doubt the default firmware would support this.
The alternative firmware I was thinking about is OpenWrt, but it does not look good: https://dev.openwrt.org/ticket/22454
Yes their is no openwrt for it ready, i tried an ethernet dongle but it is not working
Got mine and updated to version 2.12.6
and the Wifi speed fluctuates up and down constantly and is only up to 10Mbit/s while I get ~70Mbit/s with a cable or a different router.
I got this one since I wanted a more stable Router that could handle a high speed, but current version surely don’t :\
https://www.youtube.com/watch?v=VQ35zI8W3ns
So its the fastest Asus router you can get right ?
i can’t understand russian can someone explaine me what he is saying?
So last night I managed to get Asus firmware on my router! Not easy, not so hard, helps I speak Russian and Ukrainian a little. I would suggest watching the video a few times. And I didn’t make notes, so this is from memory… and dont blame me if it breaks, have a backup router in case, i was prepared to brick, almost did several times, in the end it worked once i had root, easy. And its an awesome router now. And hilariously, i did it from a laptop, over wifi. SSD I think helps the 1 hour compile.
What you need, and thanks to the guy who did this, amazing really cool the way it does everything automagically 😉
http://prometheus.freize.net/index.html
Old Firmware: https://www.dropbox.com/s/y5tsgcjr1gxz7uq/miwifi_r3_all_55ac7_2.11.20.bin?dl=0
Virtualbox – https://www.virtualbox.org/wiki/Downloads
Virtualbox Image – https://yadi.sk/d/6EpD2EpHmB82o
or
Vmware Player – https://my.vmware.com/en/web/vmware/free#desktop_end_user_computing/vmware_workstation_player/12_0
Vmware Image – https://yadi.sk/d/6EpD2EpHmB82o
Watch the video, because at some point, you might be without internet!! https://www.youtube.com/watch?v=VQ35zI8W3ns
Flash the old image i linked (not sure the new dev one works) from above using mi3 interface
reboot router, configure it a little like you did before, so you have net access again, this allows you to run the virtual machine and let it update itself over the internet
Start virtual machine (install above, double click/open image)
Let it update itself 😉 nice scripts
L Language – english (Very important, there is an english langage option on this tool) )))
0 ssh (type ip, login, password), if it fails see below to get root
4 firmware, 3 compile
wait forever!
once compile is done, say yes to flasy u-boot even if you have latest version
4 firmware, 4 flash firmware
yes etc
done, easy
To root
login to router
http://192.168.31.1/cgi-bin/luci/;stok=2ca162de9aa42e55e30c8f9fe35031c4/web/home#router
2ca162de9aa42e55e30c8f9fe35031c4
Cut the bit between stok= and / above, save it. Then the url’s below change with your string
Then edit the following url’s and substitute your code for the code in the url in my case 2ca..1c4
click on each url
In my circumstance, i got errors on all but the last url which returned 0 (OK).
Then I repeated from 0 above and this time it worked as i had root 🙂
http://192.168.31.1/cgi-bin/luci/;stok=2ca162de9aa42e55e30c8f9fe35031c4/api/xqnetwork/set_wifi_ap?ssid=Xiaomi&encryption=NONE&enctype=NONE&channel=1%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit
http://192.168.31.1/cgi-bin/luci/;stok=2ca162de9aa42e55e30c8f9fe35031c4/api/xqnetwork/set_wifi_ap?ssid=Xiaomi&encryption=NONE&enctype=NONE&channel=1%3B%2Fetc%2Finit.d%2Fdropbear%20start
http://192.168.31.1/cgi-bin/luci/;stok=2ca162de9aa42e55e30c8f9fe35031c4/api/xqsystem/set_name_password?oldPwd=12345678&newPwd=12345678
Good luck )
hiw to unblock a blocked device…Hiw to bring up the blocklist?
@PeterP
Thanks for the walkthrough @PeterP !
I just ran through the Prometheus Script and have this flying!
Hi guys, i just got my mi 3 router and able to connect to internet wifi via mobile apps. the problem now is on the apps need to pair the router and key in pairing/admin password which I didnt know. I try the same key as wifi key/SSID name but got wrong password. Maybe all you guys can help me regarding this issue. TQVM in advance.
@lancer
First create a Mi Account at https://account.xiaomi.com. Login to the MiWiFi Router app with this account and then use the router web admin password to pair it with app.
Thanks Bruno, at last I managed to configure. Actually something wrong with the default configuration n need to reset a few times….
@PeterP
Hello @PeterP – it is probably worth to mention that Prometheus script was fully translated to English and available as VMWare image (VMWARE-PROMETHEUS-64-U-EN.zip) on the same location. I tried it last weekend and modded my Mi3 without any issues.
https://yadi.sk/d/6EpD2EpHmB82o
Hi,
I bought this router but I only see the 2.4ghz network on inSSIDER. Do I need to enable 5ghz somewhere in the webinterface ?
@Mathieu
you probably solved your issue but i’d like to mention the following thing, having played with my Xiaomi mini router (the old one with 2 antennas).
The 5GHz channels table of those firmwares use the Chinese configuration which starts right after the end of the european (and us?) channels.
Meaning that when on “auto” mode the 5GHz defaults to channel 149, and the sees no local SSIDs and of course its own SSID is not seen from other euro routers (my ipad did see the chinese channel ssid so you can check with those more relaxed international devices)..
Now, it also has some DFS channels which are on lower frequencies, so setting the 5GHz AP to of of them will then let it be seen by local routers and the scan will work and see local 5GHz SSIDs..
I’m not using a native openwrt on my Xiaomi Mini as i understood there are some wifi stability issues, so i’ve installed a “pandora” firmware which should be a cleanup of an original xiaomi firmware, and i don’t know how much of my remarks is related to the fact it’s still a chinese firmware.
“iw reg get” did show a country code 00 (international table) and setting it to my local country did no change the behaviour of the “auto” mode which always defaults to the first chinese channel.
I haven’t tested it long enough to comment on stability, speed tests in AC mode to my ISP box gave around 80Mbps iperf speeds with a signal level around 60% (i didn’t see the -db level, 5GHz range is much lower than 2.4GHz).
One last thing concerning my Mini, i did find an api injection hack tutorial to root the device, so no app / dev stuff was required.
I’ll order one of those Xiaomi Router 3 and see how it works but it should perform in the same manner, not sure what the 4 antennas bring to the table.
It might be worth to mention that the router is attempting every ~5 minutes to connect to 2 Chinese websites. I could not stop it in any way – there is no user setting to disable this. One of them seemed to be API for xiaomi – possibly remote management (not needed for me), the other one was unknown chinese website (to me).
As I could not stop it, I unplugged it and put it to my drawer – LEDE project for now does not support the router, so I will not touch it with the original firmware.
This is not the first Xiaomi device with backdoor or reporting back to mothership (google Redmi 1S).