New Xiaomi router AC2100

Can you double check that your mtd-eeprom offsets are correct? The RM2100 has the 7603 at 0x0 of factory and the 7615 at 0x8000, but you seem to have yours flipped on your R2100 dts.

that's interesting! I have actually the RM2100 layout on my R2100, because I got the flashed NAND from @Percy's RM2100. I'll check it again, but as both mt7615 and mt7603 get loaded properly it should be right ...

Edit: I'm starting to think we might need a subtarget or another one entirely for the two devices.

I agree!

I tried to convert Redmi AC2100 router from NAND to SPI. I desolder NAND and i soldering a Winbond SPI 128Mb. With a CH341A programmer i write full dump from mi 3Gv2, but without succes. Router not boot and serial interface not responding. :frowning: Pins configuration i got them from here http://www.t-firefly.com/download/FireWRT/hardware/MT7621.pdf but
i don't know exactly if I did it correctly. Any ideea why this doesn't work or any help? Thank you

Did you update the CHIP_MODE ?

I don't not know how to update CHIP_MODE. I write full dump from 3Gv2 with SPI version. All hardware component, except wifi chip 5G, is indentical with Redmi Ac2100. It should have been working normally, but unfortunately not boot and I do not know why. I guess the connection between SPI flash and the processor is the problem! Can anyone confirm if connection is ok? This http://www.t-firefly.com/download/FireWRT/hardware/MT7621.pdf tell me the NAND_ and SPI_ pin is the same.

In you schematic DI => Data in is connected to MISO => Master In Slave Out.
I'm not familiar with DI notation but DATA IN could be Slave IN no ?

Did you connect them directly ? Check with a logical Analyzer if you see some pins moving. Maybe one is muxed as OD and need you need a Pull-Up.
Also you can connect WP# and HOLD# to VDD directly just in case...

For the CHIP mode i don't know if the BootRom will fallback to other mode if no NAND is found.

This is the logic by which I was guided:


Yes, pin has been connected directly, i dot have logical Analyzer to test pins.
I tried to connect WP# and HOLD# to VCC pin nands directly, but without success, router not boot! :frowning: I find this : and I hoped it would work on the AC2100.

Does anyone have any Xiaomi router with a MT7621 procesor to measure with a multimeter if NAND pins is the same as SPI? All family Xiaomi router has NAND and SPI circuit on the motherboard, except Redmi AC2100. This is the only way we can find out which pins are used. I think it would be cool if we could install SPI in our routers.

Anybody here who can share the stock kernel0.bin /kernel1.bin for the ac2100 (black cylinder)??

I have modded a XIAOMI R3G ( SPI 128M 8 pins W25Q128FV )
Nand removed and add SPI
https://4pda.ru/forum/index.php?showtopic=837667&st=1000#entry65661552

only jumper J10 J11
for firmware i use Pandorabox PBR-M1 ( 16M not 128M )
run also with OpenWRT but i use PandoraBox because OpenWrt not route Orange TV Flux

look ru forum:
https://4pda.ru/forum/index.php?showtopic=973368

2 Likes

If you're trying to revert to stock you can just setup dnsmasq to serve up the signed firmware images, and u-boot will pull and flash them when you power on with the reset pin pressed.

Unless you're trying to extract stock dtb or other configs from the stock image...

1 Like

Thanks for answer @anon69880279! Unfortunately I don't have any jumper on mainboard or any circuit for SPI.

Only way to find pins is with a multimeter. If you have a multimeter please select on buzzer and measure pin from NAND to SPI , to view if is the same, have continuity, and have corespondents. Important to identify corespondents for this pins: DI, DO, CLK and CS from SPI with pins from NAND.

pins are good with a multimeter

possible chip enable as R3G J10 J11 & R4 ?

I tried to convert Redmi AC2100 router from NAND to SPI. I desolder NAND and i soldering a Winbond SPI 128Mb.

For me R3G nand is F51L1G81 1Gb not 128Mb and i use PBR-M1 firmware

This might be a silly question, but why exactly are you trying to solder on SPI flash?

Did you already manage to destroy the endurance on your chips?

You can already toggle on uart_en and bootdelay without having to desolder and put it in a programmer too...

On Xiaomi Mi3G this help in case you have badblocks on NAND, or your bootloader is corrupt. With help of SPI you could restore NAND or make a dual boot...

Are you measured DI, DO, CLK and CS from SPI?Is the same with pins from NAND? GND and VCC is sure, but I don't know how enable CHIP_SELECT after, because I don't have any jumper on mainboard. As far as I know pin 9 on the NAND is the one responsible for CHIP_SELECT but possible to be something else. Unfortunately under NAND don't have any SPI circuits:

Yes I know, but I have the modified firmware of the RM2100 in my R2100, therefore I can only upgrade with the R2100 software. The good thing is that it works without any problems, I still would prefer to have the right kernel for my device installed that I can install the right original firmware.
So is there any way to extract a flashable kernel image from the firmware.bin or can we only do it from an installation by dumping the kernel partition??

Did anyone succeeded in exploiting AC2100 OEM firmware using this:
https://gist.github.com/namidairo/1e3fb3404c9f148474c06ae6616962f3 ?

It seems PatrickM managed to get it working (eventually) earlier in the thread, so at least I know it works on at least one other person's unit...

Do note that it does target 1.0.14, as that's the one image downloadable on the Xiaomi site one can recover to at the moment. I would encourage people to save themselves a copy. I don't think Xiaomi would be able to effectively stop downgrades/recovery to that image without flashing a new u-boot version with the image blacklisted, but I don't think they'd do that in the field as they haven't done it before.

I've been working on documenting the general process on the OpenWrt wiki and getting the RM2100/Redmi Router AC2100 into master in the meantime.

https://openwrt.org/inbox/toh/xiaomi/xiaomi_redmi_router_ac2100

I think I messed up the article creation though.

2 Likes

WOWWWWWWWWWWWWWWWWWWW

this expilot pppd-cve.py
work for black cylinder AC2100 r2100 v2.0.376

NO NEED REMOVE NAND

THANK YOU FOR ALL

Yes it does work i've used it on the black cylinder AC2100 model. Please don't spread false info. If it doesn't work on first try just run the script again until it does.