|
楼主 |
发表于 2019-8-9 18:21
|
显示全部楼层
小米路由器Pro/R3P从潘多拉刷回官方固件
本帖最后由 fyi2000 于 2020-3-3 01:48 编辑
刷机有风险,请考虑清楚再动手
小米路由器Pro/R3P刷机之前必须先查明闪存代码,刷错固件,轻则半砖,重则全砖
- dmesg | grep "Manufacturer ID"
复制代码- [ 3.370000] NAND device: Manufacturer ID: 0xc8, Chip ID: 0xda (Unknown NAND 256MiB 3,3V 8-bit), 256MiB, page size: 2048, OOB size: 64
- nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xda
复制代码- [ 3.430000] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron NAND 256MiB 3,3V 8-bit), 256MiB, page size: 2048, OOB size: 64
- nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xda
复制代码 0xc8=ESMT闪存,直刷旧版名称包含 "_all_" 的官方固件就可以同时刷回官方u-boot
0x2c=Micron闪存,必须刷最新的u-boot,不可刷旧版官方固件,刷错必定变砖,刷回官方分两阶段,先恢复最新固件,再恢复u-boot
此外不知何故,小米路由器Pro/R3P特别容易产生坏块,我怀疑和pb-boot/潘多拉有关(失敬了lintel大神),但我没有任何证据,只是看多了R3/R3P变砖的例子,多半都是刷了潘多拉,坏块的位置会影响刷机的方式,一般来说,最安全的办法是先刷一个过渡的 "initramfs-kernel.bin",再以 PuTTY 登陆后台刷 "sysupggrade.bin",在此不讨论细节,只提供信息参考
以下是一个没有坏块的R3P运行dmesg所得到的结果:
- [ 3.390000] Scanning device for bad blocks
- [ 3.680000] Signature matched and data read!
- [ 3.680000] load_fact_bbt success 2047
- [ 3.680000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.690000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.700000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.710000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.720000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.730000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.740000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.750000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.760000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.770000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.780000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.790000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.800000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.810000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.820000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 3.830000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
复制代码 以下是一个有坏块的R3P运行dmesg所得到的结果:
- [ 3.450000] Scanning device for bad blocks
- [ 3.490000] Bad eraseblock 131 at 0x000001060000
- [ 3.490000] Bad eraseblock 143 at 0x0000011e0000
- [ 3.500000] Bad eraseblock 161 at 0x000001420000
- [ 3.520000] Bad eraseblock 197 at 0x0000018a0000
- [ 3.580000] Bad eraseblock 426 at 0x000003540000
- [ 3.590000] Bad eraseblock 446 at 0x0000037c0000
- [ 3.600000] Bad eraseblock 452 at 0x000003880000
- [ 3.620000] Bad eraseblock 525 at 0x0000041a0000
- [ 4.020000] Signature matched and data read!
- [ 4.020000] load_fact_bbt success 2047
- [ 4.030000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.040000] c0 00 00 c0 00 00 00 00 0c 00 00 00 00 00 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.050000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.060000] 00 00 00 00 00 00 00 00 00 00 30 00 00 00 00 30 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.060000] 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.070000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.080000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.090000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.100000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.110000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.120000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.130000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.140000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.150000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.160000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
- [ 4.170000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
复制代码 fact_bbt = factory bad block table
有无坏块不影响刷回官方,但会影响刷第三方固件
方法一:
以下方法同时适配新 (Micron闪存) 旧 (ESMT闪存) 小米路由器Pro/R3P从潘多拉刷回官方固件
- 下载最新R3P开发版固件至FAT32单分区U盘根目录,并重新命名为 miwifi.bin
- 下载同时适配 ESMT & Micron 闪存的官方 mtd1.bin (Bootloader) 备份至U盘根目录
- 按住复位键,上电,等5秒放开,登陆 pb-boot 后台 192.168.1.1,刷官方 kernel0.bin 备份
- 断电,插入U盘,上电,等5秒 (不可太早按下复位键,不要登陆 pb-boot),按住复位键不放直到橙灯闪烁才放开,再等数分钟直到蓝灯长亮
- 如果有线网口状态显示网线拔出则连接无线,这是由于还没换掉pb-boot所导致
- 电脑运行PuTTY,登陆 192.168.31.1:22,Android手机请安装 JuiceSSH,Termius 或 ConnectBot
- df -h
- mtd write /extdisks/sda1/mtd1.bin Bootloader && mtd verify /extdisks/sda1/mtd1.bin Bootloader
复制代码 请依据 df -h 找到U盘路径,自行修改 sdaX,X=1,2,3...
方法二:
以下方法仅适配旧 (ESMT闪存) 小米路由器Pro/R3P从潘多拉刷回官方固件
- 下载 miwifi_r3p_all_75bd9_2.10.41.bin 至FAT32单分区U盘根目录,并重新命名为 miwifi.bin
- 按住复位键,上电,等5秒放开,登陆 pb-boot 后台 192.168.1.1,刷官方 kernel0.bin 备份
- 断电,插入U盘,上电,等5秒 (不可太早按下复位键,不要登陆 pb-boot),按住复位键不放直到橙灯闪烁才放开,再等数分钟直到蓝灯长亮
- 登陆官方后台升级至最新固件
以上文件若无备份则可至盘古论坛下载 Index of /刷机说明/小米路由器Pro/xiaomi-pro/ (感谢lintel大神)
系统更新 - 小米路由器Pro - 小米帮助中心
OpenWrt Project: Xiaomi R3P Pro
小米路由器Pro/R3P官方固件分区
- root@XiaoQiang:~# cat /proc/mtd
- dev: size erasesize name
- mtd0: 0ff80000 00020000 "ALL"
- mtd1: 00040000 00020000 "Bootloader"
- mtd2: 00040000 00020000 "Config"
- mtd3: 00040000 00020000 "Bdata"
- mtd4: 00040000 00020000 "Factory"
- mtd5: 00040000 00020000 "crash"
- mtd6: 00080000 00020000 "crash_syslog"
- mtd7: 00040000 00020000 "reserved0"
- mtd8: 00400000 00020000 "kernel0"
- mtd9: 00400000 00020000 "kernel1"
- mtd10: 02800000 00020000 "rootfs0"
- mtd11: 02800000 00020000 "rootfs1"
- mtd12: 0a580000 00020000 "overlay
复制代码 小米路由器Pro/R3P潘多拉固件分区
- [root@PandoraBox_0860:/root]#cat /proc/mtd
- dev: size erasesize name
- mtd0: 00040000 00020000 "Bootloader"
- mtd1: 00040000 00020000 "Config"
- mtd2: 00040000 00020000 "Bdata"
- mtd3: 00040000 00020000 "Factory"
- mtd4: 00040000 00020000 "crash"
- mtd5: 00080000 00020000 "crash_syslog"
- mtd6: 00040000 00020000 "reserved0"
- mtd7: 0fd80000 00020000 "firmware"
- mtd8: 00800000 00020000 "kernel"
- mtd9: 0f540000 00020000 "ubi"
- mtd10: 00040000 00020000 "panic_oops"
- mtd11: 00080000 00020000 "factory_bbt"
复制代码 |
|