Support for Xiaomi Mi Router 4C (R4CM)

For Developers
1

Hi everyone,

Xiaomi Broght out the Mi Router 4C and it was so cheap that I just hat to get it to tinker with it. I am usually just a user of OpenWRT but i'd like to make OpenWRT available for this.

From what I gathered from disassembling it it has the following specs:
A Mediatek MT7628DAN CPU/Network Controller
16MB (128Mbit) Flash Memory (W25Q128FV)
2x 100MBit LAN
1x ? WAN

I am not so sure about the CPU though. The name that was printed on the CPU was MT7628DAN but I found sources that linekd this to the MT7628AN.

I have something that looks like through holes for TTL headers (VCC,RX,GND,TX).

How should I approach this?

2 Likes
2

I have soldered headers to the board and this is the Bootlog: https://pastebin.com/jWrcAVmL

Does anyone have an idea why the start (U-Boot?) is scrambled?

1 Like
3

Sometimes U-Boot runs at a different serial speed than the kernel

Just posted to the mailing list -- I don't know if this is the same or similar device or not
https://patchwork.ozlabs.org/patch/1095406/

[OpenWrt-Devel] [PATCH] ramips: add support for Xiaomi Mi Router 4A (100M Edition)

- SoC:      MediaTek MT7628AN
- Flash:    16MB (Winbond W25Q128JV)
- RAM:      64MB
- Serial:   As marked on PCB, 3V3 logic, baudrate is 115200
- Ethernet: 3x 10/100 Mbps (switched, 2x LAN + WAN)
- WIFI0:    MT7628AN 2.4GHz 802.11b/g/n
- WIFI1:    MT7612EN 5GHz 802.11ac
- Antennas: 4x external (2 per radio), non-detachable
- LEDs:     Programmable power-LED (two-colored, yellow/blue)
            Non-programmable internet-LED (shows WAN-activity)
- Buttons:  Reset
2 Likes
4

It is now quite the same device. But maybe I can use it as a base.

2 Likes
5

Is there any Progress on this project ?
I need an english firmware :frowning:

6

It seams to be a very similar device. Not the same (only have one radio 2.4Ghz), but I try to boot it up with the same flash image (used a ch341a to copy from one to another, keeping the original backups) and it boot without a problem.
I'm not finding the source in order to try and compile the code.

7

I manage to find out. This patch really works fine. Just need to compile the source code with the correct configuration for this model (took me a while to understand witch one is :open_mouth: ) and add some packets to make my life easier.
I have 2 units one R4AC and another R4CM both base on RA 7628 soc and both are working 100%.
For future reference I'll leave here the images I created, may be useful for other people.
@cperrin88, @Rubrex If haven't found a solution try this one:

As in per the presented patch as the instructions to install

INSTALLATION:

  1. Connect to the serial port of the router and power it up.
    If you get a prompt asking for boot-mode, go to step 3.
  2. Unplug the router after
    > Erasing SPI Flash...
    > raspi_erase: offs:20000 len:10000
    occurs on the serial port. Plug the router back in.
  3. At the prompt select option 2 (Load system code then
    write to Flash via TFTP.)
  4. Enter 192.168.1.1 as the device IP and 192.168.1.2 as the
    Server-IP.
  5. Connect your computer to LAN1 and assign it as 192.168.1.2/24.
  6. Rename the sysupgrade image to test.bin and serve it via TFTP.
  7. Enter test.bin on the serial console and press enter.

(Remember you need to have a working tftp server on your side serving a file called test.bin (for this instructions, ofc you can change the file name)

Flash the openwrt-ramips-mt76x8-xiaomi_mir4a-100m-initramfs-kernel.bin file 1st (This is real important!)
After that you can either use the same method or flash via LUCI openwrt-ramips-mt76x8-xiaomi_mir4a-100m-squashfs-sysupgrade.bin . After this do not forget to do a factory reset!

https://mega.nz/#F!piJzQYBT!C3xvHViXekbqwmf-7ApFPg

8

Hi,
would it be possible to share flash image (for SPI Flah)? I have read and save original one, but forget to back it up. I did some changes in the original save, which I load to device and I am not able to revert it back. Router does not boot anymore.
Thanks

9

How do you get the serial to slow down enough to disconnect the power at the correct time? My router just seems to completely ignore all serial keystrokes.

10

Hi, Do you still need the file? I can share it, but I have to found it first.
Sorry for the delayed response.

12

Hi, it would be great if you are able to share flash image. Thanks in advance,

13

Hello @Will_Turner ,

You will find somewhere up this post that the original console does not wait and the serial input is disabled by default.
The trick that must be done is alter the original flash firmware and change the boot delay from off to 5s for instance. after that, you can enter tftp mode and flash openwrt to ram and after that the squashfs if you like.
The image I'm searching for @colbert (yes, I've no ideia where I did store it... :\ ) shall be already modified and ready to wait 5s on boot time for rx input from serial port.

14

@colbert Here you go. This is the only one I have so it must be it.
https://mega.nz/#!gqRTnAaK!-nepAx5r7-y_dw8xY9PcH7XOBA6oR5nM97UioLwAL28

15

Hi, many thanks . I will try to rescuse the router.

16

Hello xTomax. I used your image. It working on my r4ac. But cannot save interface settings. After reboot returns to the default settings. Where could there be a mistake? Thanks and sorry for my english.

18

Thanks @xTomax, I've got it working. I followed the instructions to modify the flash the same as the 3Gv2 which I was doing at the same time and that worked perfectly.

19

Nice to know that mate!

20

That Image is from a R4AC, but as far as I can understand, may be wrong here, the internals only diff on the A(5G) chip.

Cannot save interface settings?

Any change you made is erased on every boot? Hummm, I was having a similar problem if I recall correctly, and it was one of the main reasons I wanted to flash openwrt. Didn't got the reason why. The flash it self shall be fine.

1 Like
21

Trying to flash R4CM via serial connection through UART Cable.

Can anyone elaborate the installation steps, I am stuck in Putty com connection,

putty screen shows β–’β–’ΡΊ4β–’β–’Ι’`β–’β–’β–’β–’β–’β–’οΏ½T
like this and cant input any keys in putty screen

22

found out how to do it

we need a spi flash programer to program the memory chip with full dump provided by xtomax

after that follow the steps to flash

not yet tried but this is the steps to follow

and for the putty we need to make the connection with the speed 115200 to get output