Xiaomi AC1200 RC04 (RA75) - Sucessfull Flash upgrade to 32M and somewhat sucessful USB Mod

Successful Flash upgrade on Xiaomi AC1200 Extender RC04 using breed (HiWiFi) bootloader :

Boot and Recovery Environment for Embedded Devices
Copyright (C) 2021 HackPascal <hackpascal@gmail.com>
Build date 2021-12-15 [git-f9b74d0]
Version 1.1 (r1337)

DRAM: 64MB
Platform: MediaTek MT7628AN/MT7688AN ver 1, eco 2
Board: HiWiFi HC5661A
Clocks: CPU: 575MHz, Bus: 191MHz, Ref: 40MHz
Flash: Macronix MX25L25635E (32MB) on mt7628-spi.0
Environment variables @ 0001e000 on flash bank 0, size 00001000
rt5350-eth: Using MAC address 43:ff:35:57:7c:41
eth0: MediaTek MT7628 built-in 5-port 10/100M switch

Network started on eth0, inet addr 192.168.1.1, netmask 255.255.255.0

Press any key to interrupt autoboot ... 0

Trying to boot firmware from 0x00160000 in flash bank 0 ...
Reading data into memory ...
U-Boot firmware image header detected.
    Image Name:   MIPS OpenWrt Linux-5.15.127
    Data Size:    2296388 Bytes
    Load Address: 80000000
    Entry Point:  80000000
Uncompressing data (LZMA) ... done.
Flushing cache ... done.

Starting kernel at 0x80000000...

[    0.000000] Linux version 5.15.127 (dela@ub-owrt-build) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23389-5deed175a5) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Sat Aug 19 14:01:06 2023
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is Xiaomi Mi AC1200 WLAN Range Extender RA75

-start with empty 32M bin (HxD)
-add breed (hiWifi) bin and pad to 0x20000
-from stock image get all mtds (config,factory,crash,cfg_bak,overlay) or get block from 0x20000 - 0x160000 and concatenate from 0x20000. Total size should be 0x160000

-adjust dts for firmware partition and build image

00160000   01EA0000
  • add sysupgrade bin to file (HxD) from offset 0x160000 and pad to 0x2000000.
  • burn bin using programmer
  • in breed gui enable env then restart, and in env config add new line:
autoboot.command - boot flash 0x160000

-reboot

0x000000000000-0x000000020000 : "bootloader"
0x000000020000-0x000000030000 : "config"
0x000000030000-0x000000040000 : "factory"
0x000000040000-0x000000050000 : "crash"
0x000000050000-0x000000060000 : "cfg_bak"
0x000000060000-0x000000160000 : "overlay"
0x000000160000-0x000002000000 : "firmware"

USB Mod (currently only low speed working):

It's a b* to solder...

usb usb1-port1: Cannot enable. Maybe the USB cable is bad?
usb 1-1: new high-speed USB device number 3 using ehci-platform
usb 1-1: device descriptor read/64, error -71
usb 2-1: new full-speed USB device number 2 using ohci-platform
usb 2-1: not running at top speed; connect to a high speed hub
usb-storage 2-1:1.0: USB Mass Storage device detected
scsi host0: usb-storage 2-1:1.0
scsi 0:0:0:0: Direct-Access     SanDisk  Cruzer Edge      1.27 PQ: 0 ANSI: 6
sd 0:0:0:0: [sda] 30529536 512-byte logical blocks: (15.6 GB/14.6 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
 sda: sda1 sda2 sda3 sda4
sd 0:0:0:0: [sda] Attached SCSI removable disk

The issue could be the resistor values or the wiring.
Should be 15K between D+/D- and GND. Don't have them on hand, closest in series is 14,7K. Could be the wiring, no shield. Also, low speed started working only after i added ~1,5K between D+ and 3,3V (this should be done by the device to indicate high speed, which leads me to believe it's the wires/connections).

Adding 1.5K between D- and 3.3V would indicate that it's a low speed device, and this works fine.

There is no 5V on the board (at least that i could find). The PSU is 12V. Use a DC-DC converter 12V-5V.

cat /sys/kernel/debug/usb/devices

T:  Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480  MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0002 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ehci_hcd
S:  Product=EHCI Host Controller
S:  SerialNumber=101c0000.ehci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms

T:  Bus=02 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12   MxCh= 1
B:  Alloc=  0/900 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0001 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ohci_hcd
S:  Product=Generic Platform OHCI controller
S:  SerialNumber=101c1000.ohci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   2 Ivl=255ms

T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  3 Spd=12   MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1307 ProdID=0163 Rev= 1.00
S:  Manufacturer=USBest Technology
S:  Product=USB Mass Storage Device
S:  SerialNumber=0812179677809a
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr= 80mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=  64 Ivl=8ms

Let's see...

3 Likes

USB 2.0 Working

[  987.617361] usb 1-1: new high-speed USB device number 7 using ehci-platform
[  988.007388] usb 1-1: reset high-speed USB device number 7 using ehci-platform
[  988.269704] r8152 1-1:1.0: load rtl8153a-3 v2 02/07/20 successfully
[  988.339319] r8152 1-1:1.0 eth1: v1.12.13

root@OWRT_AC1200:/# lsusb -t
/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=ohci-platform/1p, 12M
/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=ehci-platform/1p, 480M
    |__ Port 1: Dev 7, If 0, Class=, Driver=r8152, 480M
root@OWRT_AC1200:/# cat /sys/kernel/debug/usb/devices

T:  Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480  MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0002 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ehci_hcd
S:  Product=EHCI Host Controller
S:  SerialNumber=101c0000.ehci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  7 Spd=480  MxCh= 0
D:  Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  2
P:  Vendor=13b1 ProdID=0041 Rev=30.00
S:  Manufacturer=Linksys
S:  Product=Linksys USB3GIGV1
S:  SerialNumber=000001000000
C:* #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=180mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=00 Driver=r8152
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=   2 Ivl=16ms
C:  #Ifs= 2 Cfg#= 2 Atr=a0 MxPwr=180mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=
E:  Ad=83(I) Atr=03(Int.) MxPS=  16 Ivl=16ms
I:  If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

T:  Bus=02 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12   MxCh= 1
B:  Alloc=  0/900 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0001 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ohci_hcd
S:  Product=Generic Platform OHCI controller
S:  SerialNumber=101c1000.ohci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   2 Ivl=255ms

1 Like

USB Working and stable.

Remove the 1K resistors connected to GND

Solder 15K resistors to GND from D+ and D-

12V/5V DC-DC converter installed in the PSU

Modded case, reused USB connector from the DC-DC converter

Completed:

Output:

root@OWRT_AC1200:~# lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux 5.15.127 ehci_hcd EHCI Host Controller
Bus 002 Device 002: ID 0fe6:9700  USB 2.0 10/100M Ethernet Adaptor
Bus 002 Device 001: ID 1d6b:0001 Linux 5.15.127 ohci_hcd Generic Platform OHCI controller
root@OWRT_AC1200:~# dmesg | grep usb
[    4.316960] usbcore: registered new interface driver usbfs
[    4.322786] usbcore: registered new interface driver hub
[    4.328301] usbcore: registered new device driver usb
[    4.398579] phy phy-10120000.usbphy.0: remote usb device wakeup disabled
[    4.405431] phy phy-10120000.usbphy.0: UTMI 16bit 30MHz
[    4.634889] usbcore: registered new interface driver usb-storage
[    4.644482] usbcore: registered new interface driver uas
[    5.300247] usb 2-1: new full-speed USB device number 2 using ohci-platform
[   14.492937] hso: drivers/net/usb/hso.c: Option Wireless
[   14.498469] usbcore: registered new interface driver hso
[   14.643233] usbcore: registered new interface driver r8152
[   14.654342] usbcore: registered new interface driver ums-alauda
[   14.665616] usbcore: registered new interface driver ums-cypress
[   14.675148] usbcore: registered new interface driver ums-datafab
[   14.686023] usbcore: registered new interface driver ums-freecom
[   14.695495] usbcore: registered new interface driver ums-isd200
[   14.706332] usbcore: registered new interface driver ums-jumpshot
[   14.717521] usbcore: registered new interface driver ums-karma
[   14.727296] usbcore: registered new interface driver ums-sddr09
[   14.738592] usbcore: registered new interface driver ums-sddr55
[   14.748259] usbcore: registered new interface driver ums-usbat
[   14.765607] usbcore: registered new interface driver asix
[   14.775399] usbcore: registered new interface driver ax88179_178a
[   14.786844] usbcore: registered new interface driver cdc_ether
[   14.813362] usbcore: registered new interface driver cdc_ncm
[   14.822131] usbcore: registered new interface driver cdc_subset
[   14.930242] dm9601 2-1:1.0 eth1: register 'dm9601' at usb-101c1000.ohci-1, Davicom DM96xx USB 10/100 Ethernet, 00:e0:xx:xx:xx:xx
[   14.942316] usbcore: registered new interface driver dm9601
root@OWRT_AC1200:~#  cat /sys/kernel/debug/usb/devices

T:  Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480  MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0002 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ehci_hcd
S:  Product=EHCI Host Controller
S:  SerialNumber=101c0000.ehci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms

T:  Bus=02 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12   MxCh= 1
B:  Alloc=  0/900 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0001 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ohci_hcd
S:  Product=Generic Platform OHCI controller
S:  SerialNumber=101c1000.ohci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   2 Ivl=255ms

T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=0fe6 ProdID=9700 Rev= 1.01
S:  Product=USB 2.0 10/100M Ethernet Adaptor
C:* #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=120mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=00(>ifc ) Sub=00 Prot=00 Driver=dm9601
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=   8 Ivl=1ms
root@OWRT_AC1200:~#

2 Likes

Thanks
I am managed to install breed.
with mtd write command.

Hi,
Given your experience with hardware mods, do you think there will be any issue with me changing from 128mbits to 256mbits flash NOR on a router? It's a Teltonika RUT240 which is based on OpenWRT. The replacement chip is electrically identical, but just has twice the memory. I'm hoping this will allow me to then load Tailscale. The installation fails because there is only 3mb free and it needed 5 free. I'll be swapping XT25F128B for XT25f256B. Thanks for any insights and advice.

-Bob