Almost supported: Xiaomi RA75 aka MiWifi Range Extender AC1200

If you cannot enter anything, the most likely explanation is that there is something wrong with your UART cable. TX works, RX does not
Please Check:

  • RX (on the device side) is connected correctly to TX on your adapter
  • Its a 3.3V adapter
  • Do not connect 3.3V/Power cable

Thanks for reponse,
i have checked the solder joint, i have tried 3.3v and 5v, i have changed 3 usb ttl, but all failed

I'm suspecting that Xiaomi has updated to a new version of Uboot and prevented keyboard input.


I see the Xiaomi hardware is very well done, like apple, so I really want to flash this router.

I see a difference in putty output with topic above, my Uboot version doesn't have "You choosed 3" when the uboot automatically enters default mode:

Any advice can let me know, thanks.

I confirm that the uboot prevent input from putty, uboot not delay for input.

I have reflash SPI and success flash openwrt. SPI flash instructions I follow this tutorial: Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit) -- fully supported and flashable with OpenWRTInvasion

I hope this helps anyone in the same situation as me.

I tried to flash my new RA75 yesterday with a CH340G board ( https://pine64.com/product/serial-console-woodpecker-edition/ ).

I had problems... connecting with 8N1, the first few seconds of the terminal output was garbage, so couldn't see the boot menu. With 7N1, I could see the whole output including boot menu, but the terminal didn't accept keyboard input. So, I thought I was stuck.

BUT. I remembered I had another USB to Serial TTL converter lying around with and FTDI FT232RL chipset ( https://www.delock.com/produkt/83117/merkmale.html ). This worked with 8N1, keyboard input was fine so I could flash OpenWRT.

So... Something is fishy with CH340G and this range extender??

hi,
i have same problem with CH340 (the terminal output was garbage).
Another USB to Serial TTL is OK

Hi,
After successfully flashing openwrt to MiWifi Range Extender AC1200, I noticed that the 5G radio is not show on Luci, do I have to do anything to enable the 5G radio or is the firmware not supporting it?

Looks like you got a different hardware revision. Can you provide a full bootlog?

I also had a strange issue today... I upgraded to 23.05.0rc2 via Attended Sysupgrade from rc1. Before the upgrade all was working well. After the upgrade both LuCI and SSH stopped working, but wifi was ok and it also continued to serve internet from the main router via LAN DHCP.

I had to reset, after which LuCI came up. I set up everything from scratch and now all is ok. Thought I'd share.

yes, this is System Log

Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.000000] Linux version 5.15.118 (builder@buildhost) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23228-cd17d8df2a) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Mon Jun 26 11:20:39 2023
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Board has DDR2
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Analog PMU set to hw control
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Digital PMU set to hw control
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] printk: bootconsole [early0] enabled
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] MIPS: machine is Xiaomi Mi AC1200 WLAN Range Extender RA75
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Initrd not found or empty - disabling initrd
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Primary data cache 32kB, 4-way, PIPT, no aliases, linesize 32 bytes
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Zone ranges:
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Movable zone start for each node
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Early memory node ranges
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
Mon Jun 26 11:23:26 2023 kern.debug kernel: [    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
Mon Jun 26 11:23:26 2023 kern.debug kernel: [    0.000000] pcpu-alloc: [0] 0
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.000000] Kernel command line: console=ttyS0,115200 rootfstype=squashfs,jffs2
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Writing ErrCtl register=000758ea
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Readback ErrCtl register=000758ea
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] Memory: 56084K/65536K available (5951K kernel code, 607K rwdata, 748K rodata, 1196K init, 217K bss, 9452K reserved, 0K cma-reserved)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] NR_IRQS: 256
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] intc: using register map from devicetree
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] CPU Clock: 580MHz
Mon Jun 26 11:23:26 2023 kern.crit kernel: [    0.000000] timer_probe: no matching timers found
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 6590553264 ns
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.000002] sched_clock: 32 bits at 290MHz, resolution 3ns, wraps every 7405115902ns
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.007634] Calibrating delay loop... 385.84 BogoMIPS (lpj=1929216)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.073551] pid_max: default: 32768 minimum: 301
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.079119] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.086145] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.102521] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.112060] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.118819] pinctrl core: initialized pinctrl subsystem
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.126055] NET: Registered PF_NETLINK/PF_ROUTE protocol family
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.132356] thermal_sys: Registered thermal governor 'step_wise'
Mon Jun 26 11:23:26 2023 kern.err kernel: [    0.240237] mt7620-pci 10140000.pcie: Port 0 N_FTS = 1b105000
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.410878] PCI host bridge to bus 0000:00
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.414800] pci_bus 0000:00: root bus resource [mem 0x20000000-0x2fffffff]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.421491] pci_bus 0000:00: root bus resource [io  0x10160000-0x1016ffff]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.428076] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.435791] pci 0000:00:00.0: [14c3:0801] type 01 class 0x060400
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.441555] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x7fffffff]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.447605] pci 0000:00:00.0: reg 0x14: [mem 0x00000000-0x0000ffff]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.453716] pci 0000:00:00.0: supports D1
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.457523] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.464593] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.472614] pci 0000:01:00.0: [14c3:7663] type 00 class 0x000280
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.478455] pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x000fffff 64bit pref]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.485400] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00003fff 64bit pref]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.492381] pci 0000:01:00.0: reg 0x20: [mem 0x00000000-0x00000fff 64bit pref]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.499447] pci 0000:01:00.0: supports D1 D2
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.503515] pci 0000:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.509924] pci 0000:01:00.0: 2.000 Gb/s available PCIe bandwidth, limited by 2.5 GT/s PCIe x1 link at 0000:00:00.0 (capable of 4.000 Gb/s with 5.0 GT/s PCIe x1 link)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.525737] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.532089] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 01
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.538528] pci 0000:00:00.0: BAR 0: no space for [mem size 0x80000000]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.544861] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x80000000]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.551593] pci 0000:00:00.0: BAR 9: assigned [mem 0x20000000-0x201fffff pref]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.558554] pci 0000:00:00.0: BAR 1: assigned [mem 0x20200000-0x2020ffff]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.565126] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff 64bit pref]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.572600] pci 0000:01:00.0: BAR 2: assigned [mem 0x20100000-0x20103fff 64bit pref]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.580087] pci 0000:01:00.0: BAR 4: assigned [mem 0x20104000-0x20104fff 64bit pref]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.587551] pci 0000:00:00.0: PCI bridge to [bus 01]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.592338] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x201fffff pref]
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.599849] clocksource: Switched to clocksource MIPS
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.606460] NET: Registered PF_INET protocol family
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.611500] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.619601] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.627717] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.635181] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.642564] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.649360] TCP: Hash tables configured (established 1024 bind 1024)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.655700] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.662050] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.669246] NET: Registered PF_UNIX/PF_LOCAL protocol family
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.674860] PCI: CLS 0 bytes, default 32
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.683391] workingset: timestamp_bits=14 max_order=14 bucket_order=0
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.696396] squashfs: version 4.0 (2009/01/31) Phillip Lougher
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.702082] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.713218] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 252)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.723635] mt7621_gpio 10000600.gpio: registering 32 gpios
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.729325] mt7621_gpio 10000600.gpio: registering 32 gpios
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.735117] mt7621_gpio 10000600.gpio: registering 32 gpios
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.741258] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.750670] printk: console [ttyS0] disabled
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.754845] 10000c00.uartlite: ttyS0 at MMIO 0x10000c00 (irq = 28, base_baud = 2500000) is a 16550A
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.763636] printk: console [ttyS0] enabled
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.772044] printk: bootconsole [early0] disabled
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.783435] spi-mt7621 10000b00.spi: sys_freq: 193333333
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.813553] spi-nor spi0.0: gd25q128 (16384 Kbytes)
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.818604] 7 fixed-partitions partitions found on MTD device spi0.0
Mon Jun 26 11:23:26 2023 kern.err kernel: [    0.825172] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
Mon Jun 26 11:23:26 2023 kern.err kernel: [    0.832657] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
Mon Jun 26 11:23:26 2023 kern.err kernel: [    0.840644] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
Mon Jun 26 11:23:26 2023 kern.err kernel: [    0.848110] OF: Bad cell count for /palmbus@10000000/spi@b00/flash@0/partitions
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.855832] Creating 7 MTD partitions on "spi0.0":
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.860751] 0x000000000000-0x000000020000 : "bootloader"
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.870248] 0x000000020000-0x000000030000 : "config"
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.876550] 0x000000030000-0x000000040000 : "factory"
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.885148] 0x000000040000-0x000000050000 : "crash"
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.891565] 0x000000050000-0x000000060000 : "cfg_bak"
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.899980] 0x000000060000-0x000000160000 : "overlay"
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.907509] 0x000000160000-0x000001000000 : "firmware"
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.914389] 2 uimage-fw partitions found on MTD device firmware
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.920514] Creating 2 MTD partitions on "firmware":
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.925560] 0x000000000000-0x0000002321b3 : "kernel"
Mon Jun 26 11:23:26 2023 kern.warn kernel: [    0.930610] mtd: partition "kernel" doesn't end on an erase/write block -- force read-only
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.942264] 0x0000002321b3-0x000000ea0000 : "rootfs"
Mon Jun 26 11:23:26 2023 kern.warn kernel: [    0.947336] mtd: partition "rootfs" doesn't start on an erase/write block boundary -- force read-only
Mon Jun 26 11:23:26 2023 kern.info kernel: [    0.958086] mtd: setting mtd8 (rootfs) as root device
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.964501] 1 squashfs-split partitions found on MTD device rootfs
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    0.970886] 0x0000005a0000-0x000000ea0000 : "rootfs_data"
Mon Jun 26 11:23:26 2023 kern.info kernel: [    1.038428] rt3050-esw 10110000.esw: mediatek esw at 0xb0110000, irq 25 initialized
Mon Jun 26 11:23:26 2023 kern.info kernel: [    1.047243] mtk_soc_eth 10100000.ethernet eth0: mediatek frame engine at 0xb0100000, irq 5
Mon Jun 26 11:23:26 2023 kern.info kernel: [    1.058163] NET: Registered PF_INET6 protocol family
Mon Jun 26 11:23:26 2023 kern.info kernel: [    1.071052] Segment Routing with IPv6
Mon Jun 26 11:23:26 2023 kern.info kernel: [    1.074920] In-situ OAM (IOAM) with IPv6
Mon Jun 26 11:23:26 2023 kern.info kernel: [    1.079029] NET: Registered PF_PACKET protocol family
Mon Jun 26 11:23:26 2023 kern.info kernel: [    1.084375] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
Mon Jun 26 11:23:26 2023 kern.info kernel: [    1.097920] 8021q: 802.1Q VLAN Support v1.8
Mon Jun 26 11:23:26 2023 kern.info kernel: [    1.117831] VFS: Mounted root (squashfs filesystem) readonly on device 31:8.
Mon Jun 26 11:23:26 2023 kern.info kernel: [    1.131675] Freeing unused kernel image (initmem) memory: 1196K
Mon Jun 26 11:23:26 2023 kern.warn kernel: [    1.137695] This architecture does not have kernel memory protection.
Mon Jun 26 11:23:26 2023 kern.info kernel: [    1.144269] Run /sbin/init as init process
Mon Jun 26 11:23:26 2023 kern.debug kernel: [    1.148422]   with arguments:
Mon Jun 26 11:23:26 2023 kern.debug kernel: [    1.148427]     /sbin/init
Mon Jun 26 11:23:26 2023 kern.debug kernel: [    1.148434]   with environment:
Mon Jun 26 11:23:26 2023 kern.debug kernel: [    1.148439]     HOME=/
Mon Jun 26 11:23:26 2023 kern.debug kernel: [    1.148445]     TERM=linux
Mon Jun 26 11:23:26 2023 user.info kernel: [    2.046570] init: Console is alive
Mon Jun 26 11:23:26 2023 user.info kernel: [    2.050840] init: - watchdog -
Mon Jun 26 11:23:26 2023 user.info kernel: [    3.315850] kmodloader: loading kernel modules from /etc/modules-boot.d/*
Mon Jun 26 11:23:26 2023 user.info kernel: [    3.404939] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
Mon Jun 26 11:23:26 2023 user.info kernel: [    3.423096] init: - preinit -
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    5.250006] random: jshn: uninitialized urandom read (4 bytes read)
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    5.440833] random: jshn: uninitialized urandom read (4 bytes read)
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    5.469791] random: jshn: uninitialized urandom read (4 bytes read)
Mon Jun 26 11:23:26 2023 kern.info kernel: [    5.541687] rt3050-esw 10110000.esw: port 0 link up
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    8.070191] jffs2: notice: (289) jffs2_build_xattr_subsystem: complete building xattr subsystem, 10 of xdatum (0 unchecked, 3 orphan) and 11 of xref (3 dead, 0 orphan) found.
Mon Jun 26 11:23:26 2023 user.info kernel: [    8.088747] mount_root: switching to jffs2 overlay
Mon Jun 26 11:23:26 2023 kern.warn kernel: [    8.099651] overlayfs: upper fs does not support tmpfile.
Mon Jun 26 11:23:26 2023 user.warn kernel: [    8.114264] urandom-seed: Seeding with /etc/urandom.seed
Mon Jun 26 11:23:26 2023 user.info kernel: [    8.304312] procd: - early -
Mon Jun 26 11:23:26 2023 user.info kernel: [    8.307678] procd: - watchdog -
Mon Jun 26 11:23:26 2023 user.info kernel: [    9.132702] procd: - watchdog -
Mon Jun 26 11:23:26 2023 user.info kernel: [    9.137846] procd: - ubus -
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    9.318229] random: ubusd: uninitialized urandom read (4 bytes read)
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    9.328278] random: ubusd: uninitialized urandom read (4 bytes read)
Mon Jun 26 11:23:26 2023 kern.notice kernel: [    9.344825] random: ubusd: uninitialized urandom read (4 bytes read)
Mon Jun 26 11:23:26 2023 user.info kernel: [    9.358120] procd: - init -
Mon Jun 26 11:23:26 2023 kern.notice kernel: [   10.478912] random: jshn: uninitialized urandom read (4 bytes read)
Mon Jun 26 11:23:26 2023 kern.notice kernel: [   10.538906] random: ubusd: uninitialized urandom read (4 bytes read)
Mon Jun 26 11:23:26 2023 kern.notice kernel: [   10.570286] random: ubus: uninitialized urandom read (4 bytes read)
Mon Jun 26 11:23:26 2023 user.info kernel: [   10.675836] kmodloader: loading kernel modules from /etc/modules.d/*
Mon Jun 26 11:23:26 2023 kern.info kernel: [   11.367600] Loading modules backported from Linux version v6.1.24-0-g0102425ac76b
Mon Jun 26 11:23:26 2023 kern.info kernel: [   11.375315] Backport generated by backports.git v5.15.92-1-44-gd6ea70fafd36
Mon Jun 26 11:23:26 2023 user.info kernel: [   11.388421] urngd: v1.0.2 started.
Mon Jun 26 11:23:26 2023 kern.info kernel: [   12.003364] mt76_wmac 10300000.wmac: ASIC revision: 76280001
Mon Jun 26 11:23:26 2023 kern.notice kernel: [   12.116703] random: crng init done
Mon Jun 26 11:23:26 2023 kern.notice kernel: [   12.120229] random: 24 urandom warning(s) missed due to ratelimiting
Mon Jun 26 11:23:26 2023 kern.info kernel: [   13.042703] mt76_wmac 10300000.wmac: Firmware Version: 20151201
Mon Jun 26 11:23:26 2023 kern.info kernel: [   13.048747] mt76_wmac 10300000.wmac: Build Time: 20151201183641
Mon Jun 26 11:23:26 2023 kern.info kernel: [   13.069853] mt76_wmac 10300000.wmac: firmware init done
Mon Jun 26 11:23:26 2023 kern.debug kernel: [   13.240962] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
Mon Jun 26 11:23:26 2023 kern.info kernel: [   13.417218] PPP generic driver version 2.4.2
Mon Jun 26 11:23:26 2023 kern.info kernel: [   13.451768] NET: Registered PF_PPPOX protocol family
Mon Jun 26 11:23:26 2023 user.info kernel: [   13.475709] kmodloader: done loading kernel modules from /etc/modules.d/*
Mon Jun 26 11:23:29 2023 user.notice dnsmasq: DNS rebinding protection is active, will discard upstream RFC1918 responses!
Mon Jun 26 11:23:29 2023 user.notice dnsmasq: Allowing 127.0.0.0/8 responses
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: started, version 2.89 cachesize 1000
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: DNS service limited to local subnets
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-nftset no-auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: UBus support enabled: connected to system bus
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: using only locally-known addresses for test
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: using only locally-known addresses for onion
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: using only locally-known addresses for localhost
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: using only locally-known addresses for local
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: using only locally-known addresses for invalid
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: using only locally-known addresses for bind
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: using only locally-known addresses for lan
Mon Jun 26 11:23:30 2023 daemon.warn dnsmasq[1]: no servers found in /tmp/resolv.conf.d/resolv.conf.auto, will retry
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: read /etc/hosts - 12 names
Mon Jun 26 11:23:30 2023 daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 0 names
Mon Jun 26 11:23:30 2023 authpriv.info dropbear[948]: Not backgrounding
Mon Jun 26 11:23:35 2023 daemon.notice wpa_supplicant[1056]: Successfully initialized wpa_supplicant
Mon Jun 26 11:23:35 2023 user.notice : Added device handler type: bonding
Mon Jun 26 11:23:35 2023 user.notice : Added device handler type: 8021ad
Mon Jun 26 11:23:35 2023 user.notice : Added device handler type: 8021q
Mon Jun 26 11:23:35 2023 user.notice : Added device handler type: macvlan
Mon Jun 26 11:23:35 2023 user.notice : Added device handler type: veth
Mon Jun 26 11:23:35 2023 user.notice : Added device handler type: bridge
Mon Jun 26 11:23:35 2023 user.notice : Added device handler type: Network device
Mon Jun 26 11:23:35 2023 user.notice : Added device handler type: tunnel
Mon Jun 26 11:23:40 2023 user.notice ucitrack: Setting up /etc/config/dhcp reload dependency on /etc/config/network
Mon Jun 26 11:23:40 2023 user.notice ucitrack: Setting up /etc/config/network reload dependency on /etc/config/wireless
Mon Jun 26 11:23:40 2023 user.notice ucitrack: Setting up /etc/config/luci-splash reload dependency on /etc/config/firewall
Mon Jun 26 11:23:40 2023 user.notice ucitrack: Setting up /etc/config/qos reload dependency on /etc/config/firewall
Mon Jun 26 11:23:40 2023 user.notice ucitrack: Setting up /etc/config/miniupnpd reload dependency on /etc/config/firewall
Mon Jun 26 11:23:41 2023 user.notice ucitrack: Setting up /etc/config/odhcpd reload dependency on /etc/config/dhcp
Mon Jun 26 11:23:41 2023 user.notice ucitrack: Setting up non-init /etc/config/fstab reload handler: /sbin/block mount
Mon Jun 26 11:23:42 2023 user.notice ucitrack: Setting up /etc/config/system reload trigger for non-procd /etc/init.d/led
Mon Jun 26 11:23:42 2023 user.notice ucitrack: Setting up /etc/config/luci_statistics reload dependency on /etc/config/system
Mon Jun 26 11:23:42 2023 user.notice ucitrack: Setting up /etc/config/dhcp reload dependency on /etc/config/system
Mon Jun 26 11:23:44 2023 kern.info kernel: [   34.355354] br-lan: port 1(eth0) entered blocking state
Mon Jun 26 11:23:44 2023 kern.info kernel: [   34.360768] br-lan: port 1(eth0) entered disabled state
Mon Jun 26 11:23:44 2023 kern.info kernel: [   34.366444] device eth0 entered promiscuous mode
Mon Jun 26 11:23:44 2023 kern.info kernel: [   34.396761] br-lan: port 1(eth0) entered blocking state
Mon Jun 26 11:23:44 2023 kern.info kernel: [   34.402173] br-lan: port 1(eth0) entered forwarding state
Mon Jun 26 11:23:44 2023 daemon.notice netifd: Interface 'lan' is enabled
Mon Jun 26 11:23:44 2023 daemon.notice netifd: Interface 'lan' is setting up now
Mon Jun 26 11:23:44 2023 daemon.notice netifd: Interface 'lan' is now up
Mon Jun 26 11:23:44 2023 daemon.info dnsmasq[1]: reading /tmp/resolv.conf.d/resolv.conf.auto
Mon Jun 26 11:23:44 2023 daemon.info dnsmasq[1]: using nameserver 1.1.1.1#53
Mon Jun 26 11:23:44 2023 daemon.info dnsmasq[1]: using only locally-known addresses for test
Mon Jun 26 11:23:44 2023 daemon.info dnsmasq[1]: using only locally-known addresses for onion
Mon Jun 26 11:23:44 2023 daemon.info dnsmasq[1]: using only locally-known addresses for localhost
Mon Jun 26 11:23:44 2023 daemon.info dnsmasq[1]: using only locally-known addresses for local
Mon Jun 26 11:23:44 2023 daemon.info dnsmasq[1]: using only locally-known addresses for invalid
Mon Jun 26 11:23:44 2023 daemon.info dnsmasq[1]: using only locally-known addresses for bind
Mon Jun 26 11:23:44 2023 daemon.info dnsmasq[1]: using only locally-known addresses for lan
Mon Jun 26 11:23:44 2023 daemon.notice netifd: bridge 'br-lan' link is up
Mon Jun 26 11:23:44 2023 daemon.notice netifd: Interface 'lan' has link connectivity
Mon Jun 26 11:23:44 2023 daemon.notice netifd: Interface 'loopback' is enabled
Mon Jun 26 11:23:44 2023 daemon.notice netifd: Interface 'loopback' is setting up now
Mon Jun 26 11:23:44 2023 daemon.notice netifd: Interface 'loopback' is now up
Mon Jun 26 11:23:44 2023 daemon.notice netifd: Network device 'eth0' link is up
Mon Jun 26 11:23:44 2023 daemon.notice netifd: Network device 'lo' link is up
Mon Jun 26 11:23:44 2023 daemon.notice netifd: Interface 'loopback' has link connectivity
Mon Jun 26 11:23:45 2023 kern.info kernel: [   35.359965] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
Mon Jun 26 11:23:46 2023 daemon.info procd: - init complete -
Mon Jun 26 11:23:46 2023 user.notice firewall: Reloading firewall due to ifup of lan (br-lan)
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: exiting on receipt of SIGTERM
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: started, version 2.89 cachesize 1000
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: DNS service limited to local subnets
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: compile time options: IPv6 GNU-getopt no-DBus UBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-nftset no-auth no-cryptohash no-DNSSEC no-ID loop-detect inotify dumpfile
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: UBus support enabled: connected to system bus
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq-dhcp[1]: DHCP, IP range 192.168.31.100 -- 192.168.31.249, lease time 12h
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for test
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for onion
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for localhost
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for local
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for invalid
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for bind
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for lan
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: reading /tmp/resolv.conf.d/resolv.conf.auto
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using nameserver 1.1.1.1#53
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for test
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for onion
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for localhost
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for local
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for invalid
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for bind
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: using only locally-known addresses for lan
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: read /etc/hosts - 12 names
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq[1]: read /tmp/hosts/dhcp.cfg01411c - 4 names
Mon Jun 26 11:23:51 2023 daemon.info dnsmasq-dhcp[1]: read /etc/ethers - 0 addresses
Mon Jun 26 11:24:06 2023 daemon.err uhttpd[1349]: [info] luci: accepted login on /admin/status/processes for root from 192.168.31.100

It seems in the log I don't see any radio1 (5GHZ) appearing.

I agree that this hardware is very well built for such a cheap device.

pci 0000:01:00.0: [14c3:7663] type 00 class 0x000280

You have a different,better wifi chip: MT7615 instead of MT7612.
Should not be hard to get supported.

How many antennas do you have?

So if there is no more uboot access, we need to get serious about finding an exploit.

I use your raw image, then I connect SPI to flash the whole raw image onto the Flash chip. So my device model RC04 will be exactly like RA75, including Uboot. And I also have 5s standby screen to be able to enter flash mode openwrt, that's how to open my uboot.

I'm wondering if I buy 5 or 10 more devices and then I flash the same raw image. I understand MAC is stored in flash memory, Do I have a duplicate mac address? I'm currently configuring the wifi mesh, I'm having some problems that I don't know if it's due to the same mac address or not, Because if the MAC is the same, there can be an endless LOOP, because the packet goes to and from the same MAC address.

I really thank you for the raw image.

I think the device has 2 antennas:
image

This is raw image RC04: https://drive.google.com/file/d/17znkv9UHGNbW9m0jV7hXY0Nxoh1V7RoY/view?usp=sharing

RC04 is the new version of RA75. As I see it, from 2023, RC04 will be produced instead of RA75. The two devices are identical in appearance. I randomly bought from 2 stores and got different model:

Sorry for my English not good

Yes, MAC is stored in Flash memory.
Cloning the complete flash will clone the MAC, which will give you trouble if two clones meet.

It might be possible to override the MAC in the config.

I ordered two more units directly from xiaomi. If its the new version, I will try to get them supported.

Hi,

I'm new with RA75 since 2 days.
I follow this topic to learn more about flashing.

In my case when boot menu is showing, it waits for 4 seconds.
If i press 1 or 2, it boot immediately.

After playing with it appear that when press reset button over 10 seconds launch a tftp sequenses.
I try to send openwrt.bin file but check is not ok, it wait another format or img file with good header.

To do that I configure tftp server DHCP server and so on on a Debian.

Two questions :

to flash with SPI file to upload is openwrt .bin file ?
Can somebody put picture board indicating where is eprom ? supposed is on backside ?

For guys who have issue with SPI 341A, I modified my 341A to get 3.3 Volts instead of 5 Volts, https://www.youtube.com/watch?v=C53-aqp4hbI or this one https://www.youtube.com/watch?v=-ln3VIZKKaE

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2023.07.02 19:13:32 =~=~=~=~=~=~=~=~=~=~=~=
[04040C0F][04040C0E][89890000][23234545][00232344]
DU Setting Cal Done
U-Boot 1.1.3 (Oct 26 2021 - 11:28:23)
Board: Ralink APSoC DRAM:  64 MB
Power on memory test. Memory size= 64 MB...OK!
relocate_code Pointer at: 83fb0000
RT2880_RSTSTAT_REG 0xc0030000
***************************
Board power on Occurred
***************************
SPI-NOR flash has JEDEC ID: 1c7118
flash manufacture id: 1c, device id 71 18
find flash: EN25QX128A
env is right!
============================================ 
Ralink UBoot Version: 4.3.0.0
-------------------------------------------- 
ASIC 7628_MP (Port5<->None)
DRAM component: 512 Mbits DDR, width 16
DRAM bus: 16 bit
Total memory: 64 MBytes
Flash component: SPI Flash
Date:Oct 26 2021  Time:11:28:23
============================================ 
icache: sets:512, ways:4, linesz:32 ,total:65536
dcache: sets:256, ways:4, linesz:32 ,total:32768 
 ##### The CPU freq = 575 MHZ #### 
 estimate memory size =64 Mbytes
RESET MT7628 PHY!!!!!!
 val = 0x4
 val = 0x0
 NetTxPacket = 0x83FE6E40 
 KSEG1ADDR(NetTxPacket) = 0xA3FE6E40 
 NetLoop,call eth_halt ! 
 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)
 Waitting for RX_DMA_BUSY status Start... done
 ETH_STATE_ACTIVE!! 
BOOTP broadcast 1
DHCPHandler: got packet: (src=67, dst=68, len=300) state: 3
Filtering pkt = 0
DHCPHandler: got DHCP packet: (src=67, dst=68, len=300) state: 3
DHCP: state=SELECTING bp_file: "openwrt-23.05.0-rc2-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin"
TRANSITIONING TO REQUESTING STATE
Bootfile: openwrt-23.05.0-rc2-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin
DhcpSendRequestPkt: Sending DHCPREQUEST
Transmitting DHCPREQUEST packet: len = 343
DHCPHandler: got packet: (src=67, dst=68, len=300) state: 4
Filtering pkt = 0
DHCPHandler: got DHCP packet: (src=67, dst=68, len=300) state: 4
DHCP State: REQUESTING
Bootfile: openwrt-23.05.0-rc2-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin
DHCP client bound to address 192.168.31.10
TFTP from server 192.168.31.100; our IP address is 192.168.31.10
Filename 'openwrt-23.05.0-rc2-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin'.
 TIMEOUT_COUNT=10,Load address: 0x80100000
Loading: *Got ARP REPLY, set server/gtwy eth addr (48:4d:7e:e0:5d:1f)
Got it
	 #################################################################
	 #################################################################
	 ################################################
done
Bytes transferred = 5898563 (5a0143 hex)
TRX MAGIC error!
Header check error!
Image verify failed!
========Upgrade fail!========

Fred

hi,
you try choice 1 for load openwrt kernel

openwrt-23.05.0-rc2-ramips-mt76x8-xiaomi_mi-ra75-initramfs-kernel.bin

then openwrt run on ram => on openwrt ui menu System > update flash sysupgrade > will write flash to flash memory

openwrt-23.05.0-rc2-ramips-mt76x8-xiaomi_mi-ra75-squashfs-sysupgrade.bin

I can't, choice is always 3.

Fred

So it detectes the keystroke, but does not read it correctly?
What does it write to the log about the keycode read?

I have not tried the "TFTP from reset" method, don't know what kind of file it expects here, but he is not happy with it:

TRX MAGIC error!
Header check error!
Image verify failed!

And yes, you use the sysupgrade.bin file for direct flashing

Will check what ASCII code sent.
Edit: code ASCII sent is OK

I read about 0x200 beginning of bin file to be remove to flash, in this forum.
But don't remember kind of hardware and method.
Will also check.
Edit: Remove first 0x200 bytes doesn't work bad checksum

Edit: i will extract with SPI hardware my firmware version, and flash with your stock raw

Fred

Do you have Dump backup stock raw image from Chip Flash ?

Hi,

I will take the one you used, provided by @jdeisenh
But before flash, I will extract the one of my RA75.

Fred

I flash direct ch341a, not need mod to 3.3v. I think 3.3v chip can Ok 5v for a short time, Flash only lasts a few minutes so it won't damage.

1 Like