Xiaomi mi wifi 3 support

i can choose option 1 from ram however the usual option 2 for flashing on the chip just gets overridden replacing it with option 3 and booting up normally

here is the example:

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 2
                                                                              0


2: System Load Linux Kernel then write to Flash via TFTP.
 Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
 Operation terminated
                     ▒

U-Boot 1.1.3 (Apr 15 2016 - 17:46:32)

Board: Ralink APSoC DRAM:  128 MB
Power on memory test. Memory size= 128 MB...OK!
relocate_code Pointer at: 87fb8000
enable ephy clock...done. rf reg 29 = 5
SSC disabled.
******************************
Software System Reset Occurred
******************************
!!! nand page size = 2048, addr len=4
..============================================
Ralink UBoot Version: 4.2.S.1
--------------------------------------------
ASIC 7620_MP (Port5<->None)
DRAM_CONF_FROM: Auto-detection
DRAM_TYPE: DDR2
DRAM component: 1024 Mbits
DRAM bus: 16 bit
Total memory: 128 MBytes
Flash component: NAND Flash
Date:Apr 15 2016  Time:17:46:32
============================================
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =128 Mbytes

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.

You choosed 3
                                                                              0

3: System Boot system code via Flash.
Booting System 2
..ranand_erase_write: offs:40000, count:20000
.Done!
done
## Booting image at bc600000 ...
   Image Name:   MIPS PandoraBox Linux-3.14.79
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1386767 Bytes =  1.3 MB
   Load Address: 80000000
   Entry Point:  80000000

Well,from what I can see confirmation with Y is needed.

Another thing I can think of Is TFTP booting kernel0 image to RAM and having USB prepared for recovery so when it boots you already need to be pressing reset

prior to flashing pandorabox i just hit 2 and plugged in it would stop and allow me to press Y/N right now i hold 2 and it just reboots and when i let go of 2 it just reboots and picks 3.

i had this in the past due to using my raspberry back at the time as a serial adapter

i will use another serial adapter since i have 2 normal ones check the cables try again and let u know

managed to get it working i have it waiting on tftp

what image could i try flashing on the device (option 2)

the stock devel version?

Yes.
If that fails try loading kernel0 and rest like in my last reply

i did flash stock using tftp and seems im getting a bootloop of this:

dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 580 MHZ ####
 estimate memory size =128 Mbytes

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.                                                                                                                                                                                  0

3: System Boot system code via Flash.
Boot failure detected on both systems
Verifying kernel1 uImage CRC, addr: 0xbc200000
Bad Magic Number,48445231
Verifying kernel2 uImage CRC, addr: 0xbc600000
Bad Magic Number,48445231
Booting System 1
..ranand_erase_write: offs:40000, count:20000
.Done!
done
## Booting image at bc200000 ...
Bad Magic Number,48445231, try to reboot
..ranand_erase_write: offs:40000, count:20000
.Done!
done

and furthermore wont it go into a complete brick after i try flashing kernel0?
that is what you have done right?

U-boot does not like checksum of stock image.
No,mine was bricked after I flashed LEDE image that I made for testing.
It just bootloops without giving me a chance to do anything.

I have not tried to flash kernel image over tftp

i remember when i first had it and hooked up serial on stock the RX to the device was blocked..
seems i still can choose an option during the bootloader though..

so most probably it can only be fixed if oneday there comes a rom which fully supports this device and is meant for tftp flashing right?

i wonder if there is a .bin file for padavan.
from what i know padavan is flashed through ssh on prometheus.

it also changes partition layout, in my wild geuss maybe that is a way of saving it

Prometheus has some firmware recovery option from what I remember

it does but unfortunately i think it first requires SSH access and then it goes by the way of rebooting with USB recovery. it also has a backup and restore function of firmware however all demands SSH access if im not mistaking. currently the only thing im able to do is operate the bootloader, try flashing files on the device or loading them on ram.

im also not that experienced to have any more clues.

the only thing coming to my mind if a version intended for this device compatible with tftp flashing

this website claims r3 UART recovery, https://w3bsit3-dns.com/forum/index.php?showtopic=736801&st=13660
the link to it however does not function with me

Hi guys! Could some fresh nand dump help us ? I have one fully workable r3 board.

Some ideias on soldering the pins to the nand an programming it via spi ?

i also have a jtag programmer. easier would be is to check if it can be recovered through serial as the link claims

can anyone check if it redirects correctly because with me it doesnt work:

The instruction on restoration through UART the console
https://w3bsit3-dns.com/forum/index.php?showtopic=736801&view=findpost&p=50915904

my lack of experience also made me try booting up the lede ram image and after obtaining SSH access to try and restore the router through prometheus ssh however when booting a ram image the partitions cannot be found

That site does not work.
If you have already prepared an plugged usb into router.
Then if you load kernel over tftp you can use reset button to recover.
You can see in stock kernel bootlog when to press reset button

so in this case kernel0? and that is ram or squashfs?

Yes,use kernel0 that I linked.
That is stock kernel backup up.
Load it over TFTP to RAM

https://drive.google.com/drive/folders/0B1VOQQ-_EIXKVTFmVWZHcFM4NGc

so the kernel0.bin from this backup also can be used for ram booting? just to be sure

going to try it out now
...

just tried it boots up in console and as u said after a bit it says "press reset button to enter usb recovery"

i did that but didnt keep it pressed for long i wonder if anyone can explain more about this proccess since normally it takes taking out the powerplug but in this case its on the devices ram.

should i keep pressing it?

because i dont want to interrupt it im waiting and all it does is show continuous dots
....

update:
turns out i had to press it immediate and keep it pressed until the orange led blinked as the usual way goes

thanks so much! its unbricked and working now!!!!

1 Like

Well,you actually dont need unplugging,you can reboot or in this case kernel loads automatically after loading over tftp.
When it starts booting you press and hold.reset because by the time when you see that kernel asks to press reset you dont have time to react.

You are stuck on what?

if any working lede image appears by the way i would be glad to test it.

also if anyone knows how to put on pandorabox i would love to hear