Xiaomi 4A Gigabit INT bootlooping after first install

I've attempted a first installation from stock of OpenWrt on a Xiaomi 4A Gigabit, international version. I applied the Invasion exploit and was able to telnet into the router.

I downloaded the openwrt-22.03.2-ramips-mt7621-xiaomi_mi-router-4a-gigabit-squashfs-sysupgrade.bin and flashed it with mtd.

After power cycling the box, I'm getting some sort of bootloop. The left LED will glow solid yellow, the right LED flashes blue briefly, then left stays solid for ~5 seconds, then off and repeat.

I assumed I had flashed the "full install" binary and not the "sysupgrade" one. So I tried all unbrick methods from the Xiaomi R4A Wiki page (TinyPXE, MIWIFIRepairTool.x86) and different images. TinyPXE logs show that the router in "recovery mode" (hold reset as you plug in the router, wait for left slow yellow flash) is able to pull images, but after ~3s the left LED starts blinking white - which AFAIK means flashing complete. After power cycle, the router goes back to the bootloop.

I tried various v2 Chinese binaries, and the v3 international from here, but none seem to be accepted by the router. The left LED goes from blinking yellow to solid for 0 to ~3 seconds, then blinks white.
I was not able to get MIWIFIRepairTool to work, even after changing the IP address to 192.168.31.100, the router just stays blinking yellow and does not pull an image.

After searching for "bootloop", I found this thread and taking a peek through the case, it seems that my flash chip could be the culprit for this issue, as the PR (link)adding support for it was very recently merged.

I thought I'd ask here before proceeding further: shouldn't I be able to flash back to stock with the unbrick procedure? If I build OpenWrt myself with the fix in, would I flash it with the same unbrick steps?

Thanks in advance :slight_smile:

what fw version is your orignal factory fw?
do you connect the serial out to check the print log?
what p/n is your flash chip?

Take a look at this thread and this issue on Github.

Looks like a fix is merged 4 days ago so you can flash snapshot images for the time being.

1 Like

Thanks for the reply. Just to state the obvious, from this bricked state I should flash the snapshot binary via TFTP?

I didn't take note of that, my bad. I went ahead and installed openwrt without noting the stock firmare version.
As for the print log, I'd need an UART to USB adaptor, correct? I don't have one on hand.

at least 3 different hw versions in the same 4AG name, you should know what is yours.

you cannot flash openwrt code via TFTP, but only a right version factory code.

Understood. Is there a table to tell which HW version I have? Is it printed on the PCB?

there's additional info at https://openwrt.org/inbox/toh/xiaomi/xiaomi_mi_router_4a_gigabit_edition

1 Like

You should be able to use TFTP to flash but I wouldn't be so sure about it. It is possible to flash OpenWrt via TFTP to Mi 4C, in theory you should be able to too.

I recommend taking a look at @frollic 's answer. If you have V2 hardware, go back to stock firmware.

Have you seen the string like 'DoReadFile' in TinyPXE log?

Yes, and the blinking on the router changed after.

I was not able to get the router to accept any other stock image after the fact.