Almost supported: Xiaomi RA75 aka MiWifi Range Extender AC1200

zulh · January 12, 2023, 3:00pm

I have one RA75 and I'm happy to test this and share my feedback. I looked at the ToH page and I saw:

You have to install it by opening the box, soldering an UART connector, connect an UART 3V Interface, flash via shell and TFTP

Since I'm very new to OpenWrt & electronics, that line isn't very clear to me. Would be really cool if you can provide some photos of which parts/pins to solder, the before vs after solder photos, the UART connectors/tools/cables you use and how the "flash via shell and TFTP" is actually done.

jdeisenh · January 14, 2023, 9:03pm

There is a bit more information in the toh page. There is a link to the FCC DB, where you'll find photos of the opened box with the connector clearly visible on the first page of the PDF.
There are also general guides about soldering and console connectors in the wiki. The process is the same here as with any other device, and it has been described many times for other devices.
So just give it a try, you are unlikely to destroy it. And you can always ask me if you are stuck.
You need:

Small screwdriver to open the box
4 pin header, standard size
soldering iron, some solder
USB 3.3V UART interface
computer for flashing
some frustration tolerance
Its not hard.And maybe you can even document the process, if you can find the time (I can't at the moment)

jdeisenh · January 14, 2023, 9:05pm

Patch has been merged. There should be an 'official' snapshot firmware soon.

zulh · January 15, 2023, 6:01am

Thank you for this tip. I’ll get the tools you shared and try it. Could you elaborate how the flash via shell and TFTP is done?

jdeisenh · January 16, 2023, 10:12am

This video shows the process for a closely related model
https://www.youtube.com/watch?v=AAii7RxG1NY&t=286s

zulh · January 16, 2023, 1:07pm

Thanks, I’ll watch the video. Btw, do you know when the merged PR will be released? I can’t see it at https://github.com/openwrt/openwrt/releases and https://github.com/openwrt/openwrt/tags. How to download the firmware?

jdeisenh · January 17, 2023, 7:52pm

The image should show up here

https://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/openwrt-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin

Currently, the buildbot building the images for this target hangs due to an unrelated problem. I have sent a fix, that still needs to be merged, so there is nothing there yet.

You can try my build:
https://drive.google.com/file/d/1N4-yeFg8L_bQWzBc04WEkwcrpc-0NnXa/view?usp=sharing

jdeisenh · January 20, 2023, 7:27pm

And finally, after many delays, a long wait to get merged, then having to fix an unrelated bug to get the buildbot going again, and then waiting 3 days for the buildbot to do its thing, the image is finally available from snapshots.
Hope it works for somebody, and let me know if not.

zulh · January 24, 2023, 11:13am

@jdeisenh - I tried your openwrt-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin file but I got this instead:

[04010C0C][04010C0D][87860000][24234746][00242348]
DU Setting Cal Done


U-Boot 1.1.3 (Apr 30 2021 - 09:18:19)

Board: Ralink APSoC DRAM:  64 MB
Power on memory test. Memory size= 64 MB...OK!
relocate_code Pointer at: 83fb0000
RT2880_RSTSTAT_REG 0xc0030000
***************************
Board power on Occurred
***************************
SPI-NOR flash has JEDEC ID: ef4018
Status Register 1 = 0x00
Status Register 3 = 0x68
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
env is right!
============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 30 2021  Time:09:18:19
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 

You choosed 2

 0 

   
2: System Load Linux Kernel then write to Flash via TFTP. 
 Warning!! Erase Linux in Flash then burn new one. Are you sure?(Y/N)
 Please Input new ones /or Ctrl-C to discard
	Input device IP (192.168.31.1) ==:192.168.31.1
	Input server IP (192.168.31.100) ==:192.168.31.100
	Input Linux Kernel filename () ==:sysupgrade.bin

 netboot_common, argc= 3 

 NetTxPacket = 0x83FE6C40 

 KSEG1ADDR(NetTxPacket) = 0xA3FE6C40 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!! 
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'sysupgrade.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: *checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (34:64:a9:10:d4:2b)
Got it
T T T T T T T T T T 
Retry count exceeded; starting again
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'sysupgrade.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: *Got ARP REPLY, set server/gtwy eth addr (34:64:a9:10:d4:2b)
Got it
T T T T T T T T T T 
Retry count exceeded; starting again
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'sysupgrade.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: *Got ARP REPLY, set server/gtwy eth addr (34:64:a9:10:d4:2b)
Got it
T T

Meanwhile, this is the normal output when I didn't press 2: Load system code then write to Flash via TFTP option after I powered on the device:

[03080C0B][03080C0D][7E7D0000][27273E3D][00272748]
DU Setting Cal Done


U-Boot 1.1.3 (Apr 30 2021 - 09:18:19)

Board: Ralink APSoC DRAM:  64 MB
Power on memory test. Memory size= 64 MB...OK!
relocate_code Pointer at: 83fb0000
RT2880_RSTSTAT_REG 0xc0030000
***************************
Board power on Occurred
***************************
SPI-NOR flash has JEDEC ID: ef4018
Status Register 1 = 0x00
Status Register 3 = 0x68
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
env is right!
============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 30 2021  Time:09:18:19
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 
 4  3  2  1  0 
   n3: System Boot system code via Flash.
##Booting System 2
Erasing SPI Flash...
raspi_erase: offs:20000 len:10000
.
Writing to SPI Flash...
.
done
## Booting image at bc8a0000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.14
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1263216 Bytes =  1.2 MB
   Load Address: 80000000
   Entry Point:  80000000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
Erasing SPI Flash...
raspi_erase: offs:20000 len:10000
.
Writing to SPI Flash...
.
done
commandline uart_en=0 factory_mode=0 mem=64m root=/dev/mtdblock9
No initrd
## Transferring control to Linux (at address 80000000) ...
## Giving linux memsize in MB, 64

Starting kernel ...


LINUX started...

 THIS IS ASIC
[    0.000000] Linux version 3.10.14 (jenkins@70c8fd09c123) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 unknown) ) #0 Thu Jun 10 01:56:47 2021
[    0.000000] 
[    0.000000]  The CPU feqenuce set to 575 MHz
[    0.000000] 
[    0.000000]  MIPS CPU sleep mode enabled.
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] Software DMA cache coherency
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] User-defined physical RAM map:
[    0.000000]  memory: 04000000 @ 00000000 (usable)
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x00000000-0x03ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x00000000-0x03ffffff]
[    0.000000] Primary instruction cache 64kB, 4-way, VIPT, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
[    0.000000] Kernel command line: console=ttyS1,115200n8 uart_en=0 factory_mode=0 mem=64m root=/dev/mtdblock9
[    0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[    0.000000] Writing ErrCtl register=000751c7
[    0.000000] Readback ErrCtl register=000751c7
[    0.000000] Memory: 61084k/65536k available (2871k kernel code, 4452k reserved, 659k data, 180k init, 0k highmem)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:128
[    0.000000] console [ttyS1] enabled
[    0.110000] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
[    0.170000] pid_max: default: 32768 minimum: 301
[    0.170000] Mount-cache hash table entries: 512
[    0.180000] NET: Registered protocol family 16
[    0.180000] RALINK_GPIOMODE = 54054444 
[    0.190000] RALINK_GPIOMODE = 54044444 
[    0.290000] ***** Xtal 40MHz *****
[    0.290000] start PCIe register access
[    0.790000] RALINK_RSTCTRL = 2400000
[    0.800000] RALINK_CLKCFG1 = fdbfffc0
[    0.800000] 
[    0.800000] *************** MT7628 PCIe RC mode *************
[    1.300000] PCIE0 enabled
[    1.310000] Port 0 N_FTS = 1b105000
[    1.310000] init_rt2880pci done
[    1.330000] bio: create slab <bio-0> at 0
[    1.340000] PCI host bridge to bus 0000:00
[    1.340000] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
[    1.350000] pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
[    1.350000] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.360000] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
[    1.360000] pci 0000:00:00.0: BAR 0: can't assign mem (size 0x80000000)
[    1.370000] pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
[    1.370000] pci 0000:00:00.0: BAR 9: assigned [mem 0x20100000-0x201fffff pref]
[    1.380000] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
[    1.380000] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit]
[    1.390000] pci 0000:01:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref]
[    1.390000] pci 0000:00:00.0: PCI bridge to [bus 01]
[    1.400000] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
[    1.400000] pci 0000:00:00.0:   bridge window [mem 0x20100000-0x201fffff pref]
[    1.410000] BAR0 at slot 0 = 0
[    1.410000] bus=0x0, slot = 0x0
[    1.410000] res[0]->start = 0
[    1.410000] res[0]->end = 0
[    1.420000] res[1]->start = 20200000
[    1.420000] res[1]->end = 2020ffff
[    1.420000] res[2]->start = 0
[    1.430000] res[2]->end = 0
[    1.430000] res[3]->start = 0
[    1.430000] res[3]->end = 0
[    1.430000] res[4]->start = 0
[    1.440000] res[4]->end = 0
[    1.440000] res[5]->start = 0
[    1.440000] res[5]->end = 0
[    1.440000] bus=0x1, slot = 0x0
[    1.450000] res[0]->start = 20000000
[    1.450000] res[0]->end = 200fffff
[    1.450000] res[1]->start = 0
[    1.460000] res[1]->end = 0
[    1.460000] res[2]->start = 0
[    1.460000] res[2]->end = 0
[    1.460000] res[3]->start = 0
[    1.470000] res[3]->end = 0
[    1.470000] res[4]->start = 0
[    1.470000] res[4]->end = 0
[    1.470000] res[5]->start = 0
[    1.480000] res[5]->end = 0
[    1.480000] cfg80211: Calling CRDA to update world regulatory domain
[    1.490000] Switching to clocksource Ralink Systick timer
[    1.490000] NET: Registered protocol family 2
[    1.500000] TCP established hash table entries: 512 (order: 0, 4096 bytes)
[    1.500000] TCP bind hash table entries: 512 (order: -1, 2048 bytes)
[    1.510000] TCP: Hash tables configured (established 512 bind 512)
[    1.510000] TCP: reno registered
[    1.520000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    1.520000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    1.530000] NET: Registered protocol family 1
[    1.550000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    1.560000] jffs2: version 2.2. (ZLIB) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    1.570000] msgmni has been set to 119
[    1.570000] io scheduler noop registered
[    1.580000] io scheduler deadline registered (default)
[    1.580000] MIWIFI panic notifier registered
[    1.590000] pcieport 0000:00:00.0: device [14c3:0801] has invalid IRQ; check vendor BIOS
[    1.600000] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    1.610000] serial8250: ttyS0 at MMIO 0x10000d00 (irq = 21) is a 16550A
[    1.610000] serial8250: ttyS1 at MMIO 0x10000c00 (irq = 20) is a 16550A
[    1.620000] led=2, on=4000, off=1, blinks,=1, reset=1, time=4000
[    1.630000] Ralink gpio driver initialized
[    1.630000] flash manufacture id: ef, device id 40 18
[    1.640000] W25Q128BV(ef 40180000) (16384 Kbytes)
[    1.640000] mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
[    1.650000] Creating 9 MTD partitions on "raspi":
[    1.660000] 0x000000000000-0x000001000000 : "ALL"
[    1.660000] 0x000000000000-0x000000020000 : "Bootloader"
[    1.670000] 0x000000020000-0x000000030000 : "Config"
[    1.680000] 0x000000030000-0x000000040000 : "Factory"
[    1.680000] 0x000000040000-0x000000050000 : "crash"
[    1.690000] 0x000000050000-0x000000060000 : "cfg_bak"
[    1.700000] 0x000000060000-0x000000160000 : "overlay"
[    1.700000] 0x000000160000-0x0000008a0000 : "OS1"
[    1.710000] 0x0000008a0000-0x000000fe0000 : "OS2"
[    1.720000] mtd: try split OS2 partition
[    1.720000] mtd: split_firmware
[    1.720000] mtd: firmware_partition->size   0x740000
[    1.730000] mtd: firmware_partition->offset 0x8a0000
[    1.730000] mtd: uimage_len 1263280
[    1.740000] mtd: uimage_len 1310720
[    1.740000] mtd: rootfs_partition->size   0x600000
[    1.750000] mtd: rootfs_partition->offset 0x9e0000
[    1.750000] mtd: partition "rootfs" created automatically, ofs=9E0000, len=600000 
[    1.760000] 0x0000009e0000-0x000000fe0000 : "rootfs"
[    1.760000] PPP generic driver version 2.4.2
[    1.770000] PPP MPPE Compression module registered
[    1.770000] NET: Registered protocol family 24
[    1.780000] GMAC1_MAC_ADRH -- : 0x00003ccd
[    1.780000] GMAC1_MAC_ADRL -- : 0x57129dd4
[    1.790000] Ralink APSoC Ethernet Driver Initilization. v3.1  256 rx/tx descriptors allocated, mtu = 1500!
[    1.800000] GMAC1_MAC_ADRH -- : 0x00003ccd
[    1.800000] GMAC1_MAC_ADRL -- : 0x57129dd4
[    1.810000] PROC INIT OK!
[    1.810000] Ralink APSoC Hardware Watchdog Timer
[    1.810000] TCP: cubic registered
[    1.820000] NET: Registered protocol family 10
[    1.830000] NET: Registered protocol family 17
[    1.830000] 8021q: 802.1Q VLAN Support v1.8
[    1.850000]  **** dump comp_opts cpue, flags=0x90014, bit_opts 90, fb 40, dictionary_size 40000 
[    1.860000] squashfs_xz_init-73, dict_size 262144, dictionary size 262144 , len 12, size 12 
[    1.870000] squashfs_xz_init-83, size 40000 vs 40000  
[    1.870000] squashfs_xz_init-87, dict_size 262144. n 18  
[    1.880000] VFS: Mounted root (squashfs filesystem) readonly on device 31:9.
[    1.890000] Freeing unused kernel memory: 180K (80373000 - 803a0000)
[    3.110000] init: Console is alive
[    4.300000] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    4.360000] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.380000] init: - preinit -
/etc/preinit: line 1: swconfig: not found
/etc/preinit: line 1: swconfig: not found
/etc/preinit: line 1: swconfig: not found
[    4.680000] Raeth v3.1 (Tasklet,SkbRecycle)
[    4.680000] 
[    4.680000] phy_tx_ring = 0x03fa2000, tx_ring = 0xa3fa2000
[    4.690000] 
[    4.690000] phy_rx_ring0 = 0x03fa3000, rx_ring0 = 0xa3fa3000
[    4.710000] config 7628 esw as LLLLW
[    4.790000] GMAC1_MAC_ADRH -- : 0x00003ccd
[    4.790000] GMAC1_MAC_ADRL -- : 0x57129dd4
[    4.800000]  Link Status Changed: Port 6 linked Up.
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    7.740000]  Link Status Changed: Port 0 linked Up.
[    8.190000] mount_root: mounting /dev/root
[    8.420000] urandom-seed: Seed file not found (/etc/urandom.seed)
-----------------------------do_data_mount_fail_recover
1+0 records in
1+0 records out
4 bytes (4B) copied, 0.009120 seconds, 438B/s
[    9.260000] ra2880stop()...Done
[    9.260000] Free TX/RX Ring Memory!
[    9.280000] procd: - early -
[    9.900000] procd: - ubus -
[    9.990000] procd: - init -
Please press Enter to activate this console.
/etc/rc.d/S00sysfixtime: Thu Jun 10 02:35:32 UTC 2021
[   11.370000] kmodloader: loading kernel modules from /etc/modules.d/*
[   11.390000] l2tp_core: L2TP core driver, V2.0
[   11.390000] l2tp_netlink: L2TP netlink interface
[   11.990000] 
[   11.990000] 
[   11.990000] === pAd = c04a1000, size = 1758600 ===
[   11.990000] 
[   12.000000] <-- RTMPAllocTxRxRingMemory, Status=0, ErrorValue=0x
[   12.000000] <-- RTMPAllocAdapterBlock, Status=0
[   12.010000] RtmpChipOpsHook(492): Not support for HIF_MT yet!
[   12.010000] mt7628_init()-->
[   12.020000] mt7628_init(FW(8a00), HW(8a01), CHIPID(7628))
[   12.020000] e2.bin mt7628_init(1117)::(2), pChipCap->fw_len(63984)
[   12.030000] mt_bcn_buf_init(218): Not support for HIF_MT yet!
[   12.040000] <--mt7628_init()
[   12.770000] <-- RTMPAllocTxRxRingMemory, Status=0
[   12.790000] <-- RTMPAllocAdapterBlock, Status=0
[   12.790000] pAd->CSRBaseAddress =0xc0a00000, csr_addr=0xc0a00000!
[   12.800000] <dbg> MAC_CSR0=1986146304, RtmpChipOpsHook
[   12.800000] <dbg> dev idx = 1!
[   12.810000] <dbg> get_dev_config_idx pAd->MACVersion = 76623000, pAd->ChipID = 76120044
[   12.830000] ip_tables: (C) 2000-2006 Netfilter Core Team
[   12.840000] Type=Linux
[   12.860000] nf_conntrack version 0.5.0 (957 buckets, 3828 max)
[   12.940000] xt_time: kernel timezone is -0000
[   12.950000] kmodloader: done loading kernel modules from /etc/modules.d/*
/etc/rc.d/S10boot: WARNING: Wifi detect is deprecated. Use wifi config instead
/etc/rc.d/S10boot: For more information, see commit 5f8f8a366136a07df661e31decce2458357c167a
/etc/rc.d/S10boot: mt7612: Detect failed
/etc/rc.d/S10boot: mt7628: Detect failed
[   14.440000] led=2, on=1, off=4000, blinks,=1, reset=1, time=1
[   14.450000] led=0, on=1, off=4000, blinks,=1, reset=1, time=1
[   14.460000] led=2, on=4000, off=1, blinks,=1, reset=1, time=1
/etc/rc.d/S19dnsmasq: cp: can't stat '/etc/dnsmasq.d/*': No such file or directory
/etc/rc.d/S19dnsmasq: sh: out of range
/etc/rc.d/S19dnsmasq: sh: out of range
/etc/rc.d/S19dnsmasq: sed: /var/etc/dnsmasq.conf.cfg01411c: No such file or directory
/etc/rc.d/S19dnsmasq: sed: /var/etc/dnsmasq.conf.cfg01411c: No such file or directory
/etc/rc.d/S20network: Set: phy[0].reg[0] = 3300
/etc/rc.d/S20network: Set: phy[1].reg[0] = 3300
/etc/rc.d/S20network: Set: phy[2].reg[0] = 3300
/etc/rc.d/S20network: Set: phy[3].reg[0] = 3300
/etc/rc.d/S20network: Set: phy[4].reg[0] = 3300
/etc/rc.d/S20network: uci: Entry not found
/etc/rc.d/S20network: sh: out of range
/etc/rc.d/S20network: uci: Invalid argument
/etc/rc.d/S20network: uci: Invalid argument
/etc/rc.d/S21nginx: start fcgi-cgi by spawn-fcgi.
/etc/rc.d/S21nginx: start nginx ok.
[   17.610000] TX_BCN DESC a30a8000 size = 320
[   17.620000] RX[0] DESC a30aa000 size = 2048
[   17.620000] RX[1] DESC a30ab000 size = 1024
[   17.680000] E2pAccessMode=2
[   17.680000] cfg_mode=9
[   17.680000] cfg_mode=9
[   17.680000] wmode_band_equal(): Band Equal!
[   17.950000] load fw image from fw_header_image
[   17.960000] AndesMTLoadFwMethod1(2183)::pChipCap->fw_len(63984)
[   17.970000] CmdAddressLenReq:(ret = 0)
[   17.970000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   17.970000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   17.980000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   17.980000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   17.990000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.000000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.000000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.010000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.010000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.020000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.020000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.030000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.030000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.040000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.040000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.050000] AndesInitCmdMsg:cmd_type:238,ExtCmdType:0
[   18.050000] CmdFwStartReq: override = 1, address = 1048576
[   18.060000] CmdStartDLRsp: WiFI FW Download Success
[   18.140000] MtAsicDMASchedulerInit(): DMA Scheduler Mode=0(LMAC)
[   18.140000] efuse_probe: efuse = 10000002
[   18.150000] RtmpChipOpsEepromHook::e2p_type=2, inf_Type=4
[   18.150000] RtmpEepromGetDefault::e2p_dafault=2
[   18.160000] RtmpChipOpsEepromHook: E2P type(2), E2pAccessMode = 2, E2P default = 2
[   18.160000] NVM is FLASH mode
[   18.170000] 1. Phy Mode = 14
/etc/init.d/network: ifconfig: SIOCGIFFLAGS: No such device
[   18.330000] Country Region from e2p = ffff
[   18.370000] tssi_1_target_pwr_g_band = 34
[   18.370000] 2. Phy Mode = 14
[   18.370000] 3. Phy Mode = 14
[   18.380000] NICInitPwrPinCfg(11): Not support for HIF_MT yet!
[   18.380000] NICInitializeAsic(652): Not support rtmp_mac_sys_reset () for HIF_MT yet!
[   18.390000] mt_mac_init()-->
[   18.390000] MtAsicInitMac()-->
[   18.590000] mt7628_init_mac_cr()-->
[   18.590000] MtAsicSetMacMaxLen(1279): Set the Max RxPktLen=1024!
[   18.590000] <--mt_mac_init()
[   18.600000] 	WTBL Segment 1 info:
[   18.600000] 		MemBaseAddr/FID:0x28000/0
[   18.610000] 		EntrySize/Cnt:32/128
[   18.610000] 	WTBL Segment 2 info:
[   18.610000] 		MemBaseAddr/FID:0x40000/0
[   18.620000] 		EntrySize/Cnt:64/128
[   18.620000] 	WTBL Segment 3 info:
[   18.620000] 		MemBaseAddr/FID:0x42000/64
[   18.630000] 		EntrySize/Cnt:64/128
[   18.630000] 	WTBL Segment 4 info:
[   18.630000] 		MemBaseAddr/FID:0x44000/128
[   18.640000] 		EntrySize/Cnt:32/128
[   18.640000] AntCfgInit(2918): Not support for HIF_MT yet!
[   18.650000] MCS Set = ff ff 00 00 01
[   18.650000] MtAsicSetChBusyStat(846): Not support for HIF_MT yet!
/etc/init.d/network: ifconfig: SIOCGIFFLAGS: No such device
/etc/init.d/network: ifconfig: SIOCGIFFLAGS: No such device
/etc/rc.d/S49messagingagent.sh: start messagingagent ok.
[   22.920000] MtAsicSetRalinkBurstMode(2971): Not support for HIF_MT yet!
[   22.920000] MtAsicSetPiggyBack(783): Not support for HIF_MT yet!
[   22.950000] MtAsicSetTxPreamble(2950): Not support for HIF_MT yet!
[   22.960000] MtAsicSetPreTbtt(): bss_idx=0, PreTBTT timeout = 0xf0
[   22.960000] Main bssid = 3c:cd:57:a6:ed:e3
[   22.970000] <==== rt28xx_init, Status=0
[   22.970000] CmdSlotTimeSet start
[   23.000000] !!!mt7628_xq_board=RA75!!!
[   23.040000] device wl1 entered promiscuous mode
[   23.040000] br-lan1: port 1(wl1) entered forwarding state
[   23.050000] br-lan1: port 1(wl1) entered forwarding state
[   23.060000] CmdSlotTimeSet end
[   23.100000] device apcli0 entered promiscuous mode
[   23.110000] br-lan1: port 2(apcli0) entered forwarding state
[   23.110000] br-lan1: port 2(apcli0) entered forwarding state
[   23.280000] Raeth v3.1 (Tasklet,SkbRecycle)
[   23.280000] 
[   23.280000] phy_tx_ring = 0x01c6c000, tx_ring = 0xa1c6c000
[   23.290000] 
[   23.290000] phy_rx_ring0 = 0x01c6d000, rx_ring0 = 0xa1c6d000
[   23.310000] config 7628 esw as LLLLW
[   23.380000] GMAC1_MAC_ADRH -- : 0x00003ccd
[   23.390000] GMAC1_MAC_ADRL -- : 0x57129dd4
[   23.390000]  Link Status Changed: Port 0 linked Down.
[   23.450000] device eth0.1 entered promiscuous mode
[   23.460000] device eth0 entered promiscuous mode
[   23.500000] br-lan2: port 1(eth0.1) entered forwarding state
[   23.500000] br-lan2: port 1(eth0.1) entered forwarding state
[   23.560000] <dbg> MAC_CSR0=1986146304, rtmp_asic_top_init
[   23.640000] UserCfgInit set RDMode = RD_SILENCE_MODE
[   23.740000] mt7612_set_ed_cca on
[   24.360000] mt7612_set_ed_cca on
[   25.050000] br-lan1: port 1(wl1) entered forwarding state
[   25.110000] br-lan1: port 2(apcli0) entered forwarding state
[   25.500000] br-lan2: port 1(eth0.1) entered forwarding state
[   25.910000] mt7612_set_ed_cca on
[   25.910000] <==== rt28xx_init, Status=0
[   25.930000] [sched_delayed] sched: RT throttling activated
[   25.950000] device wl0 entered promiscuous mode
[   25.960000] br-lan2: port 2(wl0) entered forwarding state
[   25.960000] br-lan2: port 2(wl0) entered forwarding state
[   26.070000] device apclii0 entered promiscuous mode
[   26.070000] br-lan2: port 3(apclii0) entered forwarding state
[   26.080000] br-lan2: port 3(apclii0) entered forwarding state
[   26.220000] ##### mbss_cr_enable, BssId = 1
[   26.220000] device wl2 entered promiscuous mode
[   26.280000] br-miot: port 1(wl2) entered forwarding state
[   26.280000] br-miot: port 1(wl2) entered forwarding state
[   26.300000]  Link Status Changed: Port 0 linked Up.
/etc/init.d/network: Command failed: Not found
[   27.960000] br-lan2: port 2(wl0) entered forwarding state
[   28.080000] br-lan2: port 3(apclii0) entered forwarding state
[   28.280000] br-miot: port 1(wl2) entered forwarding state
/etc/init.d/network: Command failed: Not found
[   28.720000] br-miot: port 1(wl2) entered disabled state
Thu Jun 10 10:35:50 CST 2021 boot_check[1251]: INFO: Wireless OK
/etc/rc.d/S60iweventd: iwevent-call start ok
[   32.860000] led=2, on=1, off=4000, blinks,=1, reset=1, time=4000
[   32.900000] led=0, on=1, off=4000, blinks,=1, reset=1, time=4000
[   32.900000] led=2, on=1, off=4000, blinks,=1, reset=1, time=4000
[   32.940000] led=0, on=4000, off=1, blinks,=1, reset=1, time=4000
/etc/rc.d/S99boot_check: <btnd> main(),L146: 
/etc/rc.d/S99boot_check: <btnd> hook_gpio(),L47: <btnd> main(),L146: 
Thu Jun 10 10:35:55 CST 2021 boot_check[2363]: Booting up finished.
[   34.170000] br-lan2: port 2(wl0) entered disabled state
[   34.370000] led=37, on=1, off=4000, blinks,=1, reset=1, time=1
[   34.390000] led=44, on=1, off=4000, blinks,=1, reset=1, time=1
[   34.400000] led=46, on=1, off=4000, blinks,=1, reset=1, time=1
[   34.410000] led=46, on=10, off=10, blinks,=4000, reset=1, time=4000

I also tried installing openwrt-21.02.3-ramips-mt76x8-xiaomi_mi-router-4a-100m-initramfs-kernel.bin hoping it works so I can install squashfs-sysupgrade.bin after that (as per this video). But that didn't help:


[04010C0C][04010C0D][87860000][23234645][00232347]
DU Setting Cal Done


U-Boot 1.1.3 (Apr 30 2021 - 09:18:19)

Board: Ralink APSoC DRAM:  64 MB
Power on memory test. Memory size= 64 MB...OK!
relocate_code Pointer at: 83fb0000
RT2880_RSTSTAT_REG 0xc0030000
***************************
Board power on Occurred
***************************
SPI-NOR flash has JEDEC ID: ef4018
Status Register 1 = 0x00
Status Register 3 = 0x68
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
env is right!
============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Apr 30 2021  Time:09:18:19
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 

 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP. 

You choosed 1

 0 

   
1: System Load Linux to SDRAM via TFTP. 
 Please Input new ones /or Ctrl-C to discard
	Input device IP (192.168.31.1) ==:192.168.31.1
	Input server IP (192.168.31.100) ==:192.168.31.100
	Input Linux Kernel filename () ==:openwrt-21.02.3-ramips-mt76x8-xiaomi_mi-router-4a-100m-initramfs-kernel.bin

 netboot_common, argc= 3 

 NetTxPacket = 0x83FE6C40 

 KSEG1ADDR(NetTxPacket) = 0xA3FE6C40 

 NetLoop,call eth_halt ! 

 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)

 Waitting for RX_DMA_BUSY status Start... done


 ETH_STATE_ACTIVE!! 
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'openwrt-21.02.3-ramips-mt76x8-xiaomi_mi-router-4a-100m-initramfs-kernel.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: *checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
checksum bad
Got ARP REPLY, set server/gtwy eth addr (34:64:a9:10:d4:2b)
Got it
T T T T T T T T T T 
Retry count exceeded; starting again
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'openwrt-21.02.3-ramips-mt76x8-xiaomi_mi-router-4a-100m-initramfs-kernel.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: *Got ARP REPLY, set server/gtwy eth addr (34:64:a9:10:d4:2b)
Got it
T T T T T T T T T T 
Retry count exceeded; starting again
TFTP from server 192.168.31.100; our IP address is 192.168.31.1
Filename 'openwrt-21.02.3-ramips-mt76x8-xiaomi_mi-router-4a-100m-initramfs-kernel.bin'.

 TIMEOUT_COUNT=10,Load address: 0x80a00000
Loading: *Got ARP REPLY, set server/gtwy eth addr (34:64:a9:10:d4:2b)
Got it
T T T

Any idea?

jdeisenh · January 24, 2023, 12:10pm

Can you give me the checksum of the files you got?
sha1sum
Please try to flash the ra75 sysupgrade from snapshots directly by pressing [2].

zulh · January 24, 2023, 2:41pm

f3c02667d150afca3c9075f5e54fd7d4b6e481fd

That's what I did. Please refer to the first code block for the logs/traces. The sysupgrade.bin file in that code block was openwrt-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin from your Google Drive. I renamed that to just sysupgrade.bin to make it easier to work with. I also tried using the full filename (openwrt-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin) but that didn't work too.

zulh · January 24, 2023, 3:04pm

FWIW, I'm using:

The 'Speed' setting for Tera Term is 115200. Other settings are on default. The USB UART cable was connected to RA75 on RX, GND and TX pins. V/red pin was not connected as the RA75 already connected to my house wall socket.

For tftp software, I thought the problem was related to Tftpd64 where my RA75 can't connect/download the .bin file (because I didn't see any progress or logs inside Tftpd64 software).

Hence, I searched around - found that SolarWinds TFTP Server and gave it a try. Unfortunately, that didn't work too. I checked all the settings many times to confirm if there's anything that could block my RA75 from downloading the file. All settings in the SolarWinds TFTP Server are fine - it allows 'Transmit and Receive files' and permitted to all IP addresses.

For both Tftpd64 and SolarWinds TFTP Server steps, I set my PC IP to 192.168.31.100 and subnet mask to 255.255.255.0. For the Default Gateway and DNS server fields, I left them blank. And I disabled all networking adapters on my PC except the Ethernet. RA75 and my PC was connected using a LAN cable.

I also tried setting my PC IP to 192.168.1.2 (subnet mask 255.255.255.0) and answer the Input device IP question/prompt by setting RA75 IP to 192.168.1.1. That didn't work too.

brusarp · February 15, 2023, 4:27pm

Hi, thanks for your work!
Just installed on my RA75 from the official "OpenWrt" link.
Soldered Jtag.
The tricky part is pressing the "2" with the correct timing on the U-boot.
After installation you need to change the IP address (default 192.168.1.1) with the CLI.
Then you need to install LUCI (SNAPSHOT image, so it doesn't have it...)
Then open LUCI and you're done. Very good!

brusarp · February 15, 2023, 9:35pm

With my second RA75 I've the same error (seems that it doesn't erase nothing and boot the MI image).
I solve with this way:

press 1 to load Openwrt on RAM via TFTP
setup IP address
install LUCI
browse to LUCI address
use LUCI firmware upgrade menu and reinstall Openwrt sysupgrade image

Maybe @jdeisenh can recognize and solve this issue...

zulh · February 16, 2023, 1:40am

Sorry, what do you mean by "setup IP address" and "install LUCI" here? What exactly did you do?

brusarp · February 16, 2023, 6:27am

After install you need to set the IP address:

uci set network.lan.proto="static"
uci set network.lan.ipaddr="192.168.1.70"
uci set network.lan.netmask="255.255.255.0"
uci set network.lan.gateway="192.168.1.1"
uci set network.lan.dns="1.1.1.1"
uci commit network
/etc/init.d/network restart

after you need to install LUCI:

opkg update
opkg install luci

Also I think it is necessary to redo these commands that after installing the firmware from the "before" installation of LUCI (go overwrite the firmware...)

zulh · February 17, 2023, 5:57am

Which firmware image did you use for this step? Will this image work? If not, can you share the link?

I guess you use this image for this step. Am I correct?

jdeisenh · February 17, 2023, 6:48pm

Hi @zulh
You should use https://downloads.openwrt.org/snapshots/targets/ramips/mt76x8/openwrt-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin

But I am pretty sure that the image is not your problem. It does not seem to flash anything.
But you are pretty close if you got that far.

Something on your TFTP setup must be wrong.

What TFTP server are you using, and how did you arrive at the ip adresses?

brusarp · February 17, 2023, 9:57pm

Exactly,
the image I've used is that you linked.
But also for me one extender flash work perfectly but for the other I need to use the "ram" detour... Same TFTP, same TTL adapter, same all...

opencan · February 18, 2023, 3:13pm

Can you use this as a travel body, e.g. connect on 5G to another access point and then bridge your own access point on 2.4G and Ethernet ? Or possibly even both 2.4G & 5G