View source for Xiaomi Mi Router 3

[[Category:Devices]]
[[Category:Xiaomi]]
[[File:Xiaomi-mi-router-3.jpg|thumb|Mi Router 3]]

The Mi Router 3 is a low cost consumer router from Xiaomi. It includes both a 2.4GHz and 5GHz radio and 4 external antennas.

== Downgrading ==
The current flashing process requires being on firmware version <code>2.11.20</code>. If your router shipped with a different version, or if you upgraded it, you will need to downgrade before you flash a custom firmware. Simply download the [http://bigota.miwifi.com/xiaoqiang/rom/r3/miwifi_r3_all_55ac7_2.11.20.bin 2.11.20 firmware file] and proceed with the following instructions.

# Save the firmware file as <code>miwifi.bin</code>
# Place <code>miwifi.bin</code> on a FAT32 formatted flash drive and insert it into the router's USB port
# Hold the reset button while plugging in the router
# Once the LED starts flashing orange, release the reset button

== Flashing ==
=== Prerequisites ===
* You must be on firmware version <code>2.11.20</code>. Refer to the downgrading section if you need to downgrade. You can check your firmware verison in the web ui of the router.
* Obtain <code>kernel1.bin</code> and <code>rootfs0.bin</code> of the firmware you wish to flash

=== Steps ===
<ol>
<li>Complete the initial setup of the router</li>
<li>Log in to the router and look at the url for <code>stok=<32-sharacter-code></code></li>
<li>Load the following 3 URLs in your browser one after another, replacing <code><STOK></code> with your 32 character code</li>
<pre>http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/xqnetwork/set_wifi_ap?ssid=Xiaomi&encryption=NONE&enctype=NONE&channel=1%3Bnvram%20set%20ssh%5Fen%3D1%3B%20nvram%20commit</pre>
<pre>http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/xqnetwork/set_wifi_ap?ssid=Xiaomi&encryption=NONE&enctype=NONE&channel=1%3Bsed%20%2Di%20%22%3Ax%3AN%3As%2Fif%20%5C%5B%2E%2A%5C%3B%20then%5Cn%2E%2Areturn%200%5Cn%2E%2Afi%2F%23tb%2F%3Bb%20x%22%20%2Fetc%2Finit.d%2Fdropbear</pre>
<pre>http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/xqnetwork/set_wifi_ap?ssid=Xiaomi&encryption=NONE&enctype=NONE&channel=1%3B%2Fetc%2Finit.d%2Fdropbear%20start</pre>
After each one, you should get the response <code>{"msg":"未能连接到指定WiFi(Probe timeout)","code":1616}</code>
If you don't get this response, it is safe to retry until you do.
<li>Next, load this URL in your browser, replacing <code><STOK></code> with your 32 character code, replacing <code><OLDPWD></code> with the admin password you set for the router in step 1, and replacing <code><NEWPWD></code> with the desired SSH password</li>
<pre>http://192.168.31.1/cgi-bin/luci/;stok=<STOK>/api/xqsystem/set_name_password?oldPwd=<OLDPWD>&newPwd=<NEWPWD></pre>
You should get the response <code>{"code":0}</code>
<li>Now you may scp over the <code>kernel1.bin</code> and <code>rootfs0.bin</code> to the router, entering the new password you just set when prompted:</li>
<pre>scp lede-ramips-mt7620nand-miwifi-r3-squashfs-kernel1.bin root@192.168.31.1:/tmp/
scp lede-ramips-mt7620nand-miwifi-r3-squashfs-rootfs0.bin root@192.168.31.1:/tmp/</pre>
<li>Log in to the router via SSH:</li>
<pre>ssh root@192.168.31.1</pre>
<li>Run the following commands:</li>
<pre>
nvram set flag_last_success=1
nvram set boot_wait=on
nvram set uart_en=1
nvram commit
mtd write /tmp/lede-ramips-mt7620nand-miwifi-r3-squashfs-kernel1.bin kernel1
mtd write /tmp/lede-ramips-mt7620nand-miwifi-r3-squashfs-rootfs0.bin rootfs0
reboot
</pre>
</ol>

== Recovery ==
In the event of a bad flash, it may be possible to revert the device back to stock.

TODO: Add comprehensive list of recovery methods / Tidy up
* Stock -> stock = try downgrade instructions
* LEDE to stock via <code>fw_setenv flag_last_success 0</code> and reset button

=== Using Console Access ===
# Save kernel0.bin from [https://drive.google.com/drive/folders/0B1VOQQ-_EIXKVTFmVWZHcFM4NGc here] to a TFTP server
# Place the <code>2.11.20</code> firmware .bin on a FAT32 formatted flash drive and connect it to the router
# Boot the router and select option 1 "Load system code to SDRAM via TFTP."
# Set an IP for the router and enter the IP of the TFTP server
# Enter the name of the file (kernel0.bin)
# Wait for it to reboot
# It will print something like the following - press and hold reset unitl the LED flashes orange and it will revert back to stock:

<pre>
[    4.550000] Check for USB recovery...
[    4.580000] Both systems are corrupted... Entering recovery mode
starting pid 81, tty '': '/etc/rcS'
Press reset button to enter USB recovery
</pre>