Xiaomi Mi WiFi 3 Router Unboxing, Teardown, and Serial Console

Orange Pi Development Boards

Mi WiFi 3 is the new low cost 802.11ac WiFi router by Xiaomi that sells for about $40. GearBest send my one sample for evaluation, and today, I’ve taken some photo of the device and board, and connected the UART pin to see if the serial console was accessible for people who want to try to port OpenWrt for example.

Xiaomi Mi WiFi 3 Unboxing

There’s some information on the package, but everything is in Chinese, except the part about AC1200 meaning it supports up to 867 Mbps with 802.11ac and 300 Mbps using 802.11n.

Xiaomi_Mi_WiFi_3_AC1200_Router_PackageThe router comes with a 12V/1A power supply, and a user’s manual in Chinese only. There’s also a QR code inside the box linking to the Android and iOS apps,  available both in English and Chinese, so actually that one of the few Xiaomi product that should be easy to use outside of China without some hacks.Xiaomi_Mi_WiFi_3_Router_Power_Supply_User_Manual

The router has four external antennas.

Xiaomi_Mi_WiFi_3_RouterThe rear panel features a reset pinhole, a USB port to connect storage, two LAN ports, one WAN port, and the DC jack.

Xiaomi_Mi_WiFi_3_Rear_Panel

Xiaomi Mi WiFi 3 Router Teardown

First it looks like I only had to pop the bottom of the case with some plastic tool, but then I noticed a screw in the middle was holding it together. So I had to pierce through the sticker with my screwdriver to completely open it.

Xiaomi_Mi_WiFi_3_Router_TeardownI was a bit surprised that they had used such as large enclosure for a small board, but maybe marketing is in play here with bigger is better? [Update: Actually, it’s for the router to avoid falling backward due to the weight of the antennas]

Click to Enlarge
Click to Enlarge

Beside the three GLGNET GSD16002LF 100Mbit magnetics, the main components include Mediatek MT7612EN 802.11a/b/g/n/ac Wi-Fi 2T2R chip, a chip under a small heatsink which must be MT7620A, and NANYA NT5TU64M16HG-AC DDR2 chip (64 MB). You’ll also notice the pin for the serial console are clearly marked on the right side, but more on that below. The two 5GHz antennas are on left, and the two 2.4GHz antennas on the right in the picture above.

Click to Enlarge
Click to Enlarge

The bottom of the board features Spansion S34ML01G100TF100 flash with 128 MB capacity.

Xiaomi MiWiFi 3 Serial Console

I’ve also soldered a 4-pin header on the right side of the board (GND, Tx, Rx, and 3.3V). to check if I could indeed access the serial console with a USB to TTL debugger adapter.

Xiaomi_Mi_WiFi_3_Router_Serial_Console

Then I started minicom with the usual settings (115200 8N1), powered up the board, and I could get the serial log:

Welcome to minicom 2.7OPTIONS: I18n
Compiled on Jan 1 2014, 17:13:19.
Port /dev/ttyUSB0, 16:21:43Press CTRL-A Z for help on special keys

U-Boot 1.1.3 (Mar 16 2016 – 14:15:12)

Board: Ralink APSoC DRAM: 128 MB
Power on memory test. Memory size= 128 MB…OK!
relocate_code Pointer at: 87fb8000
enable ephy clock…done. rf reg 29 = 5
SSC disabled.
!!! nand page size = 2048, addr len=4
..============================================
Ralink UBoot Version: 4.2.S.1
——————————————–
ASIC 7620_MP (Port5None)
DRAM_CONF_FROM: Auto-detection
DRAM_TYPE: DDR2
DRAM component: 1024 Mbits
DRAM bus: 16 bit
Total memory: 128 MBytes
Flash component: NAND Flash
Date:Mar 16 2016 Time:14:15:12
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

##### The CPU freq = 580 MHZ ####
estimate memory size =128 Mbytes

Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
9: Load Boot Loader code then write to Flash via TFTP.

3: System Boot system code via Flash.
Booting System 1
..Erasing NAND Flash…
Writing to NAND Flash…
done
## Booting image at bc200000 …
Image Name: MIPS OpenWrt Linux-2.6.36
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 2616754 Bytes = 2.5 MB
Load Address: 80000000
Entry Point: 80000000
…………………………………. Verifying Checksum … OK
Uncompressing Kernel Image … OK
commandline uart_en=0 factory_mode=0 mem=128m
No initrd
## Transferring control to Linux (at address 80000000) …
## Giving linux memsize in MB, 128

Starting kernel …

LINUX started…

THIS IS ASIC
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Linux version 2.6.36 ([email protected]) (gcc version 4.6.3 6
[ 0.000000]
[ 0.000000] The CPU feqenuce set to 580 MHz
[ 0.000000] PCIE: bypass PCIe DLL.
[ 0.000000] PCIE: Elastic buffer control: Addr:0x68 -> 0xB4
[ 0.000000] disable all power about PCIe
[ 0.000000] CPU revision is: 00019650 (MIPS 24Kc)
[ 0.000000] Software DMA cache coherency
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] User-defined physical RAM map:
[ 0.000000] memory: 08000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty – disabling initrd
[ 0.000000] Zone PFN ranges:
[ 0.000000] Normal 0x00000000 -> 0x00008000
[ 0.000000] Movable zone start PFN for each node
[ 0.000000] early_node_map[1] active PFN ranges
[ 0.000000] 0: 0x00000000 -> 0x00008000
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pa2
[ 0.000000] Kernel command line: console=ttyS1,115200n8 root=/dev/ram0 uart_m
[ 0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[ 0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[ 0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Primary instruction cache 64kB, VIPT, , 4-waylinesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bys
[ 0.000000] Writing ErrCtl register=0004a6ba
[ 0.000000] Readback ErrCtl register=0004a6ba
[ 0.000000] allocated 655360 bytes of page_cgroup
[ 0.000000] please try ‘cgroup_disable=memory’ option if you don’t want memos
[ 0.000000] Memory: 123440k/131072k available (3347k kernel code, 7632k rese)
[ 0.000000] SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, N1
[ 0.000000] NR_IRQS:128
[ 0.000000] console [ttyS1] enabled
[ 0.010000] Calibrating delay loop… 385.84 BogoMIPS (lpj=1929216)
[ 0.220000] pid_max: default: 32768 minimum: 301
[ 0.220000] Mount-cache hash table entries: 512
[ 0.220000] Initializing cgroup subsys cpuacct
[ 0.230000] Initializing cgroup subsys memory
[ 0.230000] Initializing cgroup subsys net_cls
[ 0.230000] devtmpfs: initialized
[ 0.240000] NET: Registered protocol family 16
[ 0.240000] RALINK_GPIOMODE = 121b1c
[ 0.240000] RALINK_GPIOMODE = 101b1c
[ 0.440000] PPLL_CFG1=0xe44000
[ 0.450000] MT7620 PPLL lock
[ 0.450000] PPLL_DRV =0x80080504
[ 0.650000] Deassert the PCIE0 RESET.
[ 0.650000] start PCIe register access
[ 1.150000] RALINK_RSTCTRL = 2400000
[ 1.160000] RALINK_CLKCFG1 = 75afffc0
[ 1.160000]
[ 1.160000] *************** MT7620 PCIe RC mode *************
[ 1.660000] PCIE0 enabled
[ 1.670000] init_rt2880pci done
[ 1.670000] bio: create slab at 0
[ 1.680000] SCSI subsystem initialized
[ 1.680000] usbcore: registered new interface driver usbfs
[ 1.680000] usbcore: registered new interface driver hub
[ 1.690000] usbcore: registered new device driver usb
[ 1.690000] pci 0000:00:00.0: BAR 0: can’t assign mem (size 0x80000000)
[ 1.700000] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[ 1.700000] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pre]
[ 1.710000] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[ 1.710000] pci 0000:00:00.0: BAR 1: set to [mem 0x20200000-0x2020ffff] (PCI]
[ 1.720000] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64b]
[ 1.720000] pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff 64bit]
[ 1.730000] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pre]
[ 1.730000] pci 0000:00:00.0: PCI bridge to [bus 01-01]
[ 1.740000] pci 0000:00:00.0: bridge window [io disabled]
[ 1.740000] pci 0000:00:00.0: bridge window [mem 0x20000000-0x200fffff]
[ 1.750000] pci 0000:00:00.0: bridge window [mem 0x20100000-0x201fffff pre]
[ 1.750000] BAR0 at slot 0 = 0
[ 1.760000] bus=0x0, slot = 0x0
[ 1.760000] res[0]->start = 0
[ 1.760000] res[0]->end = 0
[ 1.760000] res[1]->start = 20200000
[ 1.770000] res[1]->end = 2020ffff
[ 1.770000] res[2]->start = 0
[ 1.770000] res[2]->end = 0
[ 1.770000] res[3]->start = 0
[ 1.780000] res[3]->end = 0
[ 1.780000] res[4]->start = 0
[ 1.780000] res[4]->end = 0
[ 1.780000] res[5]->start = 0
[ 1.790000] res[5]->end = 0
[ 1.790000] bus=0x1, slot = 0x0
[ 1.790000] res[0]->start = 20000000
[ 1.790000] res[0]->end = 200fffff
[ 1.800000] res[1]->start = 0
[ 1.800000] res[1]->end = 0
[ 1.800000] res[2]->start = 0
[ 1.800000] res[2]->end = 0
[ 1.810000] res[3]->start = 0
[ 1.810000] res[3]->end = 0
[ 1.810000] res[4]->start = 0
[ 1.810000] res[4]->end = 0
[ 1.820000] res[5]->start = 0
[ 1.820000] res[5]->end = 0
[ 1.820000] Switching to clocksource MIPS
[ 1.830000] NET: Registered protocol family 2
[ 1.830000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 1.840000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[ 1.850000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[ 1.850000] TCP: Hash tables configured (established 4096 bind 4096)
[ 1.860000] TCP reno registered
[ 1.860000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 1.870000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 1.870000] NET: Registered protocol family 1
[ 3.280000] RT3xxx EHCI/OHCI init.
[ 3.290000] msgmni has been set to 241
[ 3.290000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major )
[ 3.300000] io scheduler noop registered (default)
[ 3.310000] RALINK_REG_PIO7140DATA b0000670 = 0
[ 3.410000] RALINK_REG_PIO7140DATA b0000670 = 2000000
[ 3.420000] Ralink gpio driver initialized
[ 3.420000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 3.430000] serial8250: ttyS0 at MMIO 0x10000500 (irq = 37) is a 16550A
[ 3.430000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 12) is a 16550A
[ 3.440000] init reset module!
[ 3.450000] brd: module loaded
[ 3.450000] !!! nand page size = 2048, addr len=4
[ 3.460000] ra_nand_init: alloc 1350, at 87d90000 , btt(87d910c0, 100), ranf0
[ 3.470000] Creating 13 MTD partitions on “ra_nfc”:
[ 3.470000] 0x000000000000-0x000008000000 : “ALL”
[ 3.500000] 0x000000000000-0x000000040000 : “Bootloader”
[ 3.510000] 0x000000040000-0x000000080000 : “Config”
[ 3.510000] 0x000000080000-0x0000000c0000 : “Bdata”
[ 3.520000] 0x0000000c0000-0x000000100000 : “Factory”
[ 3.530000] 0x000000100000-0x000000140000 : “crash”
[ 3.530000] 0x000000140000-0x000000180000 : “crash_syslog”
[ 3.540000] 0x000000180000-0x000000200000 : “reserved0”
[ 3.540000] 0x000000200000-0x000000600000 : “kernel0”
[ 3.550000] 0x000000600000-0x000000a00000 : “kernel1”
[ 3.560000] 0x000000a00000-0x000002a00000 : “rootfs0”
[ 3.560000] 0x000002a00000-0x000004a00000 : “rootfs1”
[ 3.570000] 0x000004a00000-0x000008000000 : “overlay”
[ 3.570000] rdm_major = 253
[ 3.580000] SMACCR1 — : 0x0000f0b4
[ 3.580000] SMACCR0 — : 0x2985a41d
[ 3.580000] Ralink APSoC Ethernet Driver Initilization. v3.0 256 rx/tx desc!
[ 3.590000] SMACCR1 — : 0x0000f0b4
[ 3.600000] SMACCR0 — : 0x2985a41d
[ 3.600000] PROC INIT OK!
[ 3.610000] PPP generic driver version 2.4.2
[ 3.610000] PPP MPPE Compression module registered
[ 3.620000] NET: Registered protocol family 24
[ 3.620000] PPTP driver version 0.8.5
[ 3.630000] ehci_hcd: USB 2.0 ‘Enhanced’ Host Controller (EHCI) Driver
[ 3.750000] rt3xxx-ehci rt3xxx-ehci: Ralink EHCI Host Controller
[ 3.760000] rt3xxx-ehci rt3xxx-ehci: new USB bus registered, assigned bus nu1
[ 3.800000] rt3xxx-ehci rt3xxx-ehci: irq 18, io mem 0x101c0000
[ 3.820000] rt3xxx-ehci rt3xxx-ehci: USB 0.0 started, EHCI 1.00
[ 3.820000] hub 1-0:1.0: USB hub found
[ 3.830000] hub 1-0:1.0: 1 port detected
[ 3.830000] ohci_hcd: USB 1.1 ‘Open’ Host Controller (OHCI) Driver
[ 3.860000] rt3xxx-ohci rt3xxx-ohci: RT3xxx OHCI Controller
[ 3.860000] rt3xxx-ohci rt3xxx-ohci: new USB bus registered, assigned bus nu2
[ 3.870000] rt3xxx-ohci rt3xxx-ohci: irq 18, io mem 0x101c1000
[ 3.940000] hub 2-0:1.0: USB hub found
[ 3.940000] hub 2-0:1.0: 1 port detected
[ 3.950000] usbcore: registered new interface driver cdc_acm
[ 3.950000] cdc_acm: v0.26:USB Abstract Control Model driver for USB modems s
[ 3.960000] Initializing USB Mass Storage driver…
[ 3.970000] usbcore: registered new interface driver usb-storage
[ 3.970000] USB Mass Storage support registered.
[ 3.980000] usbcore: registered new interface driver usbserial
[ 3.980000] USB Serial support registered for generic
[ 3.990000] usbcore: registered new interface driver usbserial_generic
[ 4.000000] usbserial: USB Serial Driver core
[ 4.000000] USB Serial support registered for pl2303
[ 4.010000] usbcore: registered new interface driver pl2303
[ 4.010000] pl2303: Prolific PL2303 USB to serial adaptor driver
[ 4.020000] USB Serial support registered for TI USB 3410 1 port adapter
[ 4.030000] USB Serial support registered for TI USB 5052 2 port adapter
[ 4.030000] usbcore: registered new interface driver ti_usb_3410_5052
[ 4.040000] ti_usb_3410_5052: v0.10:TI USB 3410/5052 Serial Driver
[ 4.050000] Software Watchdog Timer: 0.07 initialized. soft_noboot=0 soft_ma)
[ 4.050000] u32 classifier
[ 4.060000] input device check on
[ 4.060000] Actions configured
[ 4.060000] Netfilter messages via NETLINK v0.30 with ipset netlink.patch.
[ 4.070000] nf_conntrack version 0.5.0 (1928 buckets, 7712 max)
[ 4.080000] xt_time: kernel timezone is -0000
[ 4.080000] GRE over IPv4 demultiplexor driver
[ 4.090000] ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Coe
[ 4.100000] TCP cubic registered
[ 4.100000] NET: Registered protocol family 10
[ 4.110000] NET: Registered protocol family 17
[ 4.110000] L2TP core driver, V2.0
[ 4.110000] PPPoL2TP kernel driver, V2.0
[ 4.120000] L2TP netlink interface
[ 4.120000] 802.1Q VLAN Support v1.8 Ben Greear <[email protected]>
[ 4.130000] All bugs added by David S. Miller <[email protected]>
[ 4.150000] Freeing unused kernel memory: 1188k freed
[ 4.240000] Loading essential drivers…
[ 4.250000] Press Ctrl+C to enter RAMFS…
[ 5.260000] Check for USB recovery…
[ 5.290000] Bringup the system…
[ 5.300000] flag_boot_rootfs=0 mounting /dev/mtd10
[ 5.310000] UBI: attaching mtd10 to ubi0
[ 5.310000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 5.320000] UBI: logical eraseblock size: 126976 bytes
[ 5.320000] UBI: smallest flash I/O unit: 2048
[ 5.330000] UBI: VID header offset: 2048 (aligned 2048)
[ 5.340000] UBI: data offset: 4096
[ 5.490000] UBI: max. sequence number: 2
[ 5.500000] UBI: attached mtd10 to ubi0
[ 5.500000] UBI: MTD device name: “rootfs0”
[ 5.510000] UBI: MTD device size: 32 MiB
[ 5.510000] UBI: number of good PEBs: 256
[ 5.520000] UBI: number of bad PEBs: 0
[ 5.520000] UBI: max. allowed volumes: 128
[ 5.530000] UBI: wear-leveling threshold: 4096
[ 5.530000] UBI: number of internal volumes: 1
[ 5.540000] UBI: number of user volumes: 1
[ 5.540000] UBI: available PEBs: 0
[ 5.550000] UBI: total number of reserved PEBs: 256
[ 5.550000] UBI: number of PEBs reserved for bad PEB handling: 4
[ 5.560000] UBI: max/mean erase counter: 1/0
[ 5.560000] UBI: image sequence number: 1026081047
[ 5.570000] UBI: background thread “ubi_bgt0d” started, PID 80
UBI device number 0, total 256 LEBs (32505856 bytes, 31.0 MiB), available 0 LEB)
[ 5.660000] UBIFS: mounted UBI device 0, volume 0, name “system”
[ 5.660000] UBIFS: mounted read-only
[ 5.670000] UBIFS: file system size: 30093312 bytes (29388 KiB, 28 MiB, 23)
[ 5.670000] UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LE)
[ 5.680000] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 5.690000] UBIFS: default compressor: zlib
[ 5.690000] UBIFS: reserved for root: 0 bytes (0 KiB)
config core ‘version’
# ROM ver
option ROM ‘2.8.12’
# channel
option CHANNEL ‘release’
# hardware platform R1AC or R1N etc.
option HARDWARE ‘R3’
# CFE ver
option UBOOT ‘1.0.2’
# Linux Kernel ver
option LINUX ‘0.1.12’
# RAMFS ver
option RAMFS ‘0.1.12’
# SQUASHFS ver
option SQAFS ‘0.1.12’
# ROOTFS ver
option ROOTFS ‘0.1.12’
#build time
option BUILDTIME ‘Wed, 16 Mar 2016 14:13:36 +0800’
#build timestamp
option BUILDTS ‘1458108816’
#build git tag
option GTAG ‘commit 17f50389a144da43f3858d508d9de41885282406’
mount: mounting proc on /proc failed: Device or resource busy
mount: mounting sysfs on /sys failed: Device or resource busy
[ 6.460000] Raeth v3.0 (Tasklet,SkbRecycle)
[ 6.460000]
[ 6.460000] phy_tx_ring = 0x074c7000, tx_ring = 0xa74c7000
[ 6.460000]
[ 6.460000] phy_rx_ring0 = 0x07df0000, rx_ring0 = 0xa7df0000
[ 6.460000] SMACCR1 — : 0x0000f0b4
[ 6.460000] SMACCR0 — : 0x2985a41d
[ 6.490000] CDMA_CSG_CFG = 81000000
[ 6.490000] GDMA1_FWD_CFG = 20710000
– preinit –
Wed Mar 16 14:27:38 UTC 2016
– regular preinit –
[ 6.670000] UBI: attaching mtd12 to ubi1
[ 6.670000] UBI: physical eraseblock size: 131072 bytes (128 KiB)
[ 6.680000] UBI: logical eraseblock size: 126976 bytes
[ 6.680000] UBI: smallest flash I/O unit: 2048
[ 6.690000] UBI: VID header offset: 2048 (aligned 2048)
[ 6.690000] UBI: data offset: 4096
[ 6.940000] UBI: max. sequence number: 122
[ 6.960000] UBI: attached mtd12 to ubi1
[ 6.960000] UBI: MTD device name: “overlay”
[ 6.970000] UBI: MTD device size: 54 MiB
[ 6.970000] UBI: number of good PEBs: 432
[ 6.980000] UBI: number of bad PEBs: 0
[ 6.980000] UBI: max. allowed volumes: 128
[ 6.990000] UBI: wear-leveling threshold: 4096
[ 6.990000] UBI: number of internal volumes: 1
[ 7.000000] UBI: number of user volumes: 1
[ 7.000000] UBI: available PEBs: 0
[ 7.000000] UBI: total number of reserved PEBs: 432
[ 7.010000] UBI: number of PEBs reserved for bad PEB handling: 8
[ 7.020000] UBI: max/mean erase counter: 1/0
[ 7.020000] UBI: image sequence number: 35629411
[ 7.030000] UBI: background thread “ubi_bgt1d” started, PID 149
UBI device number 1, total 432 LEBs (54853632 bytes, 52.3 MiB), available 0 LEB)
[ 7.080000] UBIFS: recovery needed
[ 7.130000] UBIFS: recovery completed
[ 7.130000] UBIFS: mounted UBI device 1, volume 0, name “data”
[ 7.140000] UBIFS: file system size: 52187136 bytes (50964 KiB, 49 MiB, 41)
[ 7.140000] UBIFS: journal size: 2666496 bytes (2604 KiB, 2 MiB, 21 LE)
[ 7.150000] UBIFS: media format: w4/r0 (latest is w4/r0)
[ 7.160000] UBIFS: default compressor: lzo
[ 7.160000] UBIFS: reserved for root: 2464926 bytes (2407 KiB)
/lib/preinit.sh: line 1: jffs2_not_mounted: not found
– init –
[ 7.760000] ra2880stop()…Done
[ 7.780000] Free TX/RX Ring Memory!
init started: BusyBox v1.19.4 (2016-03-16 14:06:55 CST)

Please press Enter to activate this console. rcS S boot: INFO: rc script run ti.
[ 8.800000] tntfs: module license ‘Commercial. For support email ntfs-suppor.
[ 8.810000] Disabling lock debugging due to kernel taint
[ 8.850000] Tuxera NTFS driver 3015.1.29 [Flags: R/W MODULE].
[ 8.950000] Tuxera FAT 12/16/32 driver version 3014.1.24 [Flags: R/W MODULE].
[ 9.010000] tun: Universal TUN/TAP device driver, 1.6
[ 9.020000] tun: (C) 1999-2004 Max Krasnyansky <[email protected]>
[ 9.040000] Mirror/redirect action on
[ 9.300000] GRE over IPv4 tunneling driver
[ 9.530000] ipt: xt_cgroup_MARK installed ok.
[ 9.600000] ip_set: protocol 6
[ 9.880000] sstack_init
[ 11.170000] [ 11.180000] [ 12.720000] [ 12.740000] CSRBaseAddress =0xc1100000, csr_addr=0xc1100000!
[ 12.750000] MAC_CSR0=1986146304, RtmpChipOpsHook
[ 12.760000] dev idx = 1!
[ 12.760000] get_dev_config_idx pAd->MACVersion = 76623000, pAd->ChipID4
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: INFO: loading exist /etc/config/ne.
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: #### Loopback configuration
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: config interface loopback
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ifname lo
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option proto static
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ipaddr 127.0.0.1
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option netmask 255.0.0.0
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: #### LAN configuration
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: config interface lan
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ifname eth0.1
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option type bridge
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option proto static
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ipaddr 192.168.31.1
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option netmask 255.255.255.0
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: #### WAN configuration
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: config interface wan
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ifname eth0.2
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option proto dhcp
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: ### IFB interface for MiQoS
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: config interface ifb
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option ifname ifb0
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: #### READY configuration
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: config interface ready
Wed Mar 16 22:27:44 CST 2016 netconfig[405]: option proto static
Wed Mar 16 22:27:45 CST 2016 netconfig[405]: option ipaddr 169.254.29.1
Wed Mar 16 22:27:45 CST 2016 netconfig[405]: option netmask 255.255.255.0
[ 15.230000] Raeth v3.0 (Tasklet,SkbRecycle)
[ 15.230000]
[ 15.230000] phy_tx_ring = 0x05e6f000, tx_ring = 0xa5e6f000
[ 15.230000]
[ 15.230000] phy_rx_ring0 = 0x05e5d000, rx_ring0 = 0xa5e5d000
[ 15.230000] SMACCR1 — : 0x0000f0b4
[ 15.230000] SMACCR0 — : 0x2985a41d
[ 15.250000] CDMA_CSG_CFG = 81000000
[ 15.260000] GDMA1_FWD_CFG = 20710000
[ 15.280000] device eth0.1 entered promiscuous mode
[ 15.290000] device eth0 entered promiscuous mode
[ 15.310000] br-lan: port 1(eth0.1) entering learning state
[ 15.310000] br-lan: port 1(eth0.1) entering learning state
[ 16.020000] MAC_CSR0=1986146304, rtmp_asic_top_init
[ 16.150000] Set_Bsd_Proc 7114 Bsd 0
[ 17.310000] br-lan: port 1(eth0.1) entering forwarding state
[ 19.370000] <==== rt28xx_init, Status=0
[ 21.640000] device wl0 entered promiscuous mode
[ 21.640000] br-lan: port 2(wl0) entering learning state
[ 21.650000] br-lan: port 2(wl0) entering learning state
[ 22.250000] Set_Bsd_Proc 6786 Bsd 0
[ 23.650000] br-lan: port 2(wl0) entering forwarding state

For some reasons, I could not access the command line, as Rx did not seem to work. Not exactly sure why yet.

As mentioned in the introduction, GearBest sent the review sample, and you could purchase the router for $34.99 shipped from their website. The router is also sold for less than $40 on Aliexpress, GeekBuying, and probably other e-retailers.

Support CNX Software - Donate via PayPal or become a Patron on Patreon

63
Leave a Reply

avatar
56 Comment threads
7 Thread replies
2 Followers
 
Most reacted comment
Hottest comment thread
36 Comment authors
Robert KlaucoMathieulongo213Davidlancer Recent comment authors
  Subscribe  
newest oldest most voted
Notify of
Phil Trickett
Guest

Does this work as a range extender as well?

It doesn’t seem worth using this as a router if the wired connections are all 10/100, but it might be useful as a range extender from my existing AC router.

Also have you seen any mention of openwrt working on this?

David
Guest
David

Dont even buy it.. waste of money

Phil Trickett
Guest

Probably for cloud control?

Harley
Guest
Harley

Can you maybe contact manufacturer about flashing other firmware?

Could you please try both OpenWRT and DD-WRT on this router?

Would love to have it evaluated for both OpenWRT and DD-WRT.

Karl Johnson
Member

I like seeing the antennas not soldered on…When will the Android box manufacturers start doing this?

Zygmunt Krynicki
Guest

Interesting little device. I’m somewhat afraid to purchase this given the utterly ancient kernel and the fact that it is relatively low on ram and flash. Still openwrt can do miracles with amounts like this. Do you know if the firmware is locked down? If this can be updated to a more recent release it would look like an interesting low-cost access point that can still process impressive bandwidth.

Ray Knight
Guest
Ray Knight

From the log messages it appears that the stock firmware is based on an older version of OpenWrt:

## Booting image at bc200000 …
Image Name: MIPS OpenWrt Linux-2.6.36

RK
Guest
RK

@cnxsoft
What the fuck? Is there a physical button for a factory reset that can revert this? I was just about to order one… :/

What’s the flash chip package? Is it socketed or soldered? I have a SOIC 8 clip and a ezp xpro that I could use to wipe everything except uboot or at least take a dump before it flips whatever bit it flips to kill off the tx…

Very sad 🙁

Ray Knight
Guest
Ray Knight

It appears that inability to access the command line is driven from a U-Boot parameter if the below line from the log is correct:

commandline uart_en=0 factory_mode=0 mem=128m

Setting uart_en=1 should result in access to the command line.

xxiao
Guest
xxiao

@Ray Knight
maybe hook a serial and stop at u-boot, change this uart_en to 1, then boot up will get Rx working?

Lieutenant Colonel Olivier South
Guest
Lieutenant Colonel Olivier South

“but maybe marketing is in play here with bigger is better?”

If the base was not sufficiently large enough, would not the weight of the four antennas as the rear tend to cause the base to much more readily tip backwards with only a very gentle slight touch?

That of course would not be a good thing and be very annoying to most people.

Harley
Guest
Harley

@cnxsoft
Not sure about Xiaomi routers but usually to debrick a bricked router by holding down a semi-hidden reset-button inside a hole with a paperclip (and keep holding it down) while pressing the power-button to power. Or some kind of combination of pressing that reset-button inside a hole with a paperclip and plugging in the power-cable.

I would think that Xiaomi support should be able to tell you how to utilize that reset-button inside a hole with a paperclip to put the router into some kind of failsafe mode which will then enable you to flash the router with a new OpenWrt firmware without having to solder anything or even having to open it up at all.

https://wiki.openwrt.org/doc/howto/generic.debrick

@Lieutenant Colonel Olivier South
That could be one reason for the oversized casing, another reason could possibly be that they just reused an existing case casting mole for a other product?

mdel
Guest
mdel

cnxsoft :
I’ve just played with the Android app, and after initial router setup, you’re being asked to sign-up for a Mi account? WTH?

Indeed, same process as the older 2 antennas version i have here.
Xiaomi definitely took lessons from apple / google as they require every user to register an account on their service to get full device support.

For that device it’s not entirely useless though, as doing so will let you get your “dev” firmware from their website which essentially gives you ssh/root access, you can then flash another openwrt firwmare if you wish to do so..

zoobab
Guest

@xxiao
how do you change that value?

zoobab
Guest

If you have a buspirate and a 2×4 SPI clamp, you could easily dump the flash chip, and maybe edit the value.

If you don’t have a buspirate, you could dump the SPI flash chip with a Raspberry Pi:

https://www.flashrom.org/RaspberryPi

zoobab
Guest

@zoobab
See also here a good page about dumping an SPI flash chip with an Rpi:

https://github.com/bibanon/Coreboot-ThinkPads/wiki/Hardware-Flashing-with-Raspberry-Pi

KiLLWarez
Guest
KiLLWarez

For older model MiMini there is port from Asus N56. It named Padavan’s firmware and shipped as source due to Asus license limitation. But it could be easily could be compiled.

After reflashed to Padavan’s n56 MiMini became much more user friendly comparing to OpenWRT and more powerful that stock Xiaomi firmware.

So when Router3 will be included into device tree it will be good router.

KiLLWarez
Guest
KiLLWarez

Don’t mess with Xiaomi routers. There are MiYouth 64mb, MiMini 128mb, Router3, Router with HDD.

p021055
Guest
p021055

Hello,
He has repeater fonction. My wifi home from 2 to 4 bars 6 bars with walls to cross. I am surprised at this because I thought I saw he was not repeater. Good surprise. I do the setting with my PC by 192.168.31.1.

p021055
Guest
p021055

p021055 :
Hello,
He has repeater fonction. My wifi home from 2 to 4 bars with 6 walls to cross. I am surprised at this because I thought I saw he was not repeater. Good surprise. I do the setting with my PC by 192.168.31.1.

Lance D'Souza
Guest
Lance D'Souza

Hey guys,

Got this router in the mail finally. Thought I’d give it a shot and throw the mini version of openwrt on it. (Same chip, thought it couldn’t hurt)
I followed the same instructions but i couldn’t get the ssh patch to work on dev version 2.11.20. As I’m typing this Xiaomi just released a new rom for their stable build to 2.10.14. I will wait for them to update their website for a new version of their developer rom and retest.

Keep you guys posted wish me luck.
If anyone has got ssh to work on this router let me know.

Sport
Guest
Lance D'Souza
Guest
Lance D'Souza

@Sport

That worked Sport! Now it seems there is a new obstacle to overcome.

As described in the OpenWRT install for the Xiaomi Mini,
cat /proc/mtd inorder to see if the partition OS1 exists.

No Dice…

Which partition should I install it in? Any suggestions?

Here is my SSH output

Lances-MacBook-Pro:~ lancedsouza$ ssh [email protected]
The authenticity of host ‘192.168.1.106 (192.168.1.106)’ can’t be established.
RSA key fingerprint is SHA256:FkHIAQOqTLZEdGjhOvFWUiZoQxHLysdubTsz/+lPkLg.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added ‘192.168.1.106’ (RSA) to the list of known hosts.
[email protected]‘s password:

BusyBox v1.19.4 (2016-04-15 17:38:14 CST) built-in shell (ash)
Enter ‘help’ for a list of built-in commands.

—————————————————–
Welcome to XiaoQiang!
—————————————————–
[email protected]:~# cd /tmp/
[email protected]:/tmp# cat /proc/mtd
dev: size erasesize name
mtd0: 08000000 00020000 “ALL”
mtd1: 00040000 00020000 “Bootloader”
mtd2: 00040000 00020000 “Config”
mtd3: 00040000 00020000 “Bdata”
mtd4: 00040000 00020000 “Factory”
mtd5: 00040000 00020000 “crash”
mtd6: 00040000 00020000 “crash_syslog”
mtd7: 00080000 00020000 “reserved0”
mtd8: 00400000 00020000 “kernel0”
mtd9: 00400000 00020000 “kernel1”
mtd10: 02000000 00020000 “rootfs0”
mtd11: 02000000 00020000 “rootfs1”
mtd12: 03600000 00020000 “overlay”
[email protected]:/tmp#

Michal
Guest
Michal

Hi
Why can I not access my webserver (web settings) using the WAN IP address. Mi WiFi routers is connected after Mikrotik router and have WAN 192.168.88.217. Other routers working but Mi WiFi not. Is there any possibilites to enable this function on Mi WiFi.

Lance D'Souza
Guest
Lance D'Souza

Ok quick update.

Flashed the file to the kernel0 and on reboot router powered back on to Xiaomi’s Software.

Flashed the file to kernel1 and now router will not boot.

Sitting with a pretty brick.

Bloodyt
Guest
Bloodyt

Ok… This means at least you found the system Partition? Or am i wrong?
Because bootloader is in bootloader i guess… So i think you havnt destroyed that…

Have you dumped this Part? No respone while booting over console-Port?

Gibbio
Guest
Gibbio

Just a question. If the OS is based on OpenWrt (as some users have reported) is under GPL/GPL2. If I ask Xiaomi they have to release the OpenWRT source code used?
At this point will be quite easy to modify it to get ssh/root access or update to a newer OpenWRT release etc.

njrbarros
Guest
njrbarros

Hi everybody,
Is there any way to change the IP address of the mi WiFi Router 3 and also the DHCP range it is using?
Thanks and regards.

Bloodyt
Guest
Bloodyt

Use chrome to translate the whole site(Build in) then its easy to find the settings you are looking for….

martin
Guest
martin

I ordered mine from GB with the discount code for “GBXMW3” final price: $31.89

Antonios
Guest
Antonios

Is there a setting to turn the menus all in English?
(not the app, NOT with Google translate, Directly by router menu)

njrbarros
Guest
njrbarros

@Bloodyt
Can you tell me how to do it? I’m not seeing how.

JustSaying
Guest
JustSaying

@Gibbio
Yeah, if you didn’t have a horde of Indian users behind you, good luck with that. Not trying to be racist, but that’s the field’s fact. Xiaomi is a GPL offender. Maybe they will answer you, “Okay, we’ll release the source-code.” just so you shut up about it, and then didn’t release anything.

They’ll promise anything just for shutting up the crowd, and super rarely actually delivers that promise.

Bloodyt
Guest
Bloodyt

@Antonios
ATM no… no english included… but with chrome its very easy!

@njrbarros
open up your Chrome browser and open the Admin-Page of your router then right-click and translate to …
https://www.youtube.com/watch?v=20HpPt5XvnY

njrbarros
Guest
njrbarros

@Bloodyt

Thanks for your help.

Jerome O'Flaherty
Guest
Jerome O'Flaherty

Hi,
Thinking of getting one of these, anybody managed to get openwrt installed without bricking the device?

I see on this website some russians guys talking about putting some ASUS firmware on it:
http://4pda.ru/forum/index.php?showtopic=736801&st=20
and this video in russian:
https://www.youtube.com/watch?v=VQ35zI8W3ns&lc=z12wsrsi3r3mc51rk04ccrix2zecfvmrvxw0k

Thanks

Gakuse
Guest
Gakuse

Does this router support WOL?

Sero
Guest
Sero

I bought 1, i am not that technical, but i got only 70 mbits. And my provider gives me 250 mbits, and i bought this because it is ac and has high speed, but it is bullcrap. How can you get ac speed with 10/100 wan and land ports? Is there any way to solder a gigabit port or some kind off mod for this router to speed some things up? And can anybody tell me how i could do it? Because i don’t know if there is a software restriction for being 10/100 port?

Ørjan Lønningen
Guest
Ørjan Lønningen

Got mine and updated to version 2.12.6
and the Wifi speed fluctuates up and down constantly and is only up to 10Mbit/s while I get ~70Mbit/s with a cable or a different router.
I got this one since I wanted a more stable Router that could handle a high speed, but current version surely don’t :\

PeterP
Guest
PeterP

https://www.youtube.com/watch?v=VQ35zI8W3ns
So its the fastest Asus router you can get right ?

sero
Guest
sero

i can’t understand russian can someone explaine me what he is saying?

PeterP
Guest
PeterP

So last night I managed to get Asus firmware on my router! Not easy, not so hard, helps I speak Russian and Ukrainian a little. I would suggest watching the video a few times. And I didn’t make notes, so this is from memory… and dont blame me if it breaks, have a backup router in case, i was prepared to brick, almost did several times, in the end it worked once i had root, easy. And its an awesome router now. And hilariously, i did it from a laptop, over wifi. SSD I think helps the 1 hour compile.

What you need, and thanks to the guy who did this, amazing really cool the way it does everything automagically 😉
http://prometheus.freize.net/index.html

Old Firmware: https://www.dropbox.com/s/y5tsgcjr1gxz7uq/miwifi_r3_all_55ac7_2.11.20.bin?dl=0
Virtualbox – https://www.virtualbox.org/wiki/Downloads
Virtualbox Image – https://yadi.sk/d/6EpD2EpHmB82o
or
Vmware Player – https://my.vmware.com/en/web/vmware/free#desktop_end_user_computing/vmware_workstation_player/12_0
Vmware Image – https://yadi.sk/d/6EpD2EpHmB82o

Watch the video, because at some point, you might be without internet!! https://www.youtube.com/watch?v=VQ35zI8W3ns

Flash the old image i linked (not sure the new dev one works) from above using mi3 interface
reboot router, configure it a little like you did before, so you have net access again, this allows you to run the virtual machine and let it update itself over the internet

Start virtual machine (install above, double click/open image)
Let it update itself 😉 nice scripts
L Language – english (Very important, there is an english langage option on this tool) )))

0 ssh (type ip, login, password), if it fails see below to get root

4 firmware, 3 compile
wait forever!

once compile is done, say yes to flasy u-boot even if you have latest version
4 firmware, 4 flash firmware
yes etc
done, easy

To root
login to router
http://192.168.31.1/cgi-bin/luci/;stok=2ca162de9aa42e55e30c8f9fe35031c4/web/home#router
2ca162de9aa42e55e30c8f9fe35031c4
Cut the bit between stok= and / above, save it. Then the url’s below change with your string

Then edit the following url’s and substitute your code for the code in the url in my case 2ca..1c4
click on each url
In my circumstance, i got errors on all but the last url which returned 0 (OK).
Then I repeated from 0 above and this time it worked as i had root 🙂

http://192.168.31.1/cgi-bin/luci/;stok=2ca162de9aa42e55e30c8f9fe35031c4/api/xqnetwork/set_wifi_ap?ssid=Xiaomi&encryption=NONE&enctype=NONE&channel=1%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit
http://192.168.31.1/cgi-bin/luci/;stok=2ca162de9aa42e55e30c8f9fe35031c4/api/xqnetwork/set_wifi_ap?ssid=Xiaomi&encryption=NONE&enctype=NONE&channel=1%3B%2Fetc%2Finit.d%2Fdropbear%20start
http://192.168.31.1/cgi-bin/luci/;stok=2ca162de9aa42e55e30c8f9fe35031c4/api/xqsystem/set_name_password?oldPwd=12345678&newPwd=12345678

Good luck )

Parnava Debnath
Guest
Parnava Debnath

hiw to unblock a blocked device…Hiw to bring up the blocklist?

Lance D'Souza
Guest
Lance D'Souza

@PeterP
Thanks for the walkthrough @PeterP !

I just ran through the Prometheus Script and have this flying!