Xiaomi AC1200 RC04 (RA75) - Sucessfull Flash upgrade to 32M and somewhat sucessful USB Mod

Successful Flash upgrade on Xiaomi AC1200 Extender RC04 using breed (HiWiFi) bootloader :

Boot and Recovery Environment for Embedded Devices
Copyright (C) 2021 HackPascal <hackpascal@gmail.com>
Build date 2021-12-15 [git-f9b74d0]
Version 1.1 (r1337)

DRAM: 64MB
Platform: MediaTek MT7628AN/MT7688AN ver 1, eco 2
Board: HiWiFi HC5661A
Clocks: CPU: 575MHz, Bus: 191MHz, Ref: 40MHz
Flash: Macronix MX25L25635E (32MB) on mt7628-spi.0
Environment variables @ 0001e000 on flash bank 0, size 00001000
rt5350-eth: Using MAC address 43:ff:35:57:7c:41
eth0: MediaTek MT7628 built-in 5-port 10/100M switch

Network started on eth0, inet addr 192.168.1.1, netmask 255.255.255.0

Press any key to interrupt autoboot ... 0

Trying to boot firmware from 0x00160000 in flash bank 0 ...
Reading data into memory ...
U-Boot firmware image header detected.
    Image Name:   MIPS OpenWrt Linux-5.15.127
    Data Size:    2296388 Bytes
    Load Address: 80000000
    Entry Point:  80000000
Uncompressing data (LZMA) ... done.
Flushing cache ... done.

Starting kernel at 0x80000000...

[    0.000000] Linux version 5.15.127 (dela@ub-owrt-build) (mipsel-openwrt-linux-musl-gcc (OpenWrt GCC 12.3.0 r23389-5deed175a5) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 Sat Aug 19 14:01:06 2023
[    0.000000] Board has DDR2
[    0.000000] Analog PMU set to hw control
[    0.000000] Digital PMU set to hw control
[    0.000000] SoC Type: MediaTek MT7628AN ver:1 eco:2
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019655 (MIPS 24KEc)
[    0.000000] MIPS: machine is Xiaomi Mi AC1200 WLAN Range Extender RA75

-start with empty 32M bin (HxD)
-add breed (hiWifi) bin and pad to 0x20000
-from stock image get all mtds (config,factory,crash,cfg_bak,overlay) or get block from 0x20000 - 0x160000 and concatenate from 0x20000. Total size should be 0x160000

-adjust dts for firmware partition and build image

00160000   01EA0000
  • add sysupgrade bin to file (HxD) from offset 0x160000 and pad to 0x2000000.
  • burn bin using programmer
  • in breed gui enable env then restart, and in env config add new line:
autoboot.command - boot flash 0x160000

-reboot

0x000000000000-0x000000020000 : "bootloader"
0x000000020000-0x000000030000 : "config"
0x000000030000-0x000000040000 : "factory"
0x000000040000-0x000000050000 : "crash"
0x000000050000-0x000000060000 : "cfg_bak"
0x000000060000-0x000000160000 : "overlay"
0x000000160000-0x000002000000 : "firmware"

USB Mod (currently only low speed working):

It's a b* to solder...

usb usb1-port1: Cannot enable. Maybe the USB cable is bad?
usb 1-1: new high-speed USB device number 3 using ehci-platform
usb 1-1: device descriptor read/64, error -71
usb 2-1: new full-speed USB device number 2 using ohci-platform
usb 2-1: not running at top speed; connect to a high speed hub
usb-storage 2-1:1.0: USB Mass Storage device detected
scsi host0: usb-storage 2-1:1.0
scsi 0:0:0:0: Direct-Access     SanDisk  Cruzer Edge      1.27 PQ: 0 ANSI: 6
sd 0:0:0:0: [sda] 30529536 512-byte logical blocks: (15.6 GB/14.6 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Write cache: disabled, read cache: enabled, doesn't support DPO or FUA
 sda: sda1 sda2 sda3 sda4
sd 0:0:0:0: [sda] Attached SCSI removable disk

The issue could be the resistor values or the wiring.
Should be 15K between D+/D- and GND. Don't have them on hand, closest in series is 14,7K. Could be the wiring, no shield. Also, low speed started working only after i added ~1,5K between D+ and 3,3V (this should be done by the device to indicate high speed, which leads me to believe it's the wires/connections).

Adding 1.5K between D- and 3.3V would indicate that it's a low speed device, and this works fine.

There is no 5V on the board (at least that i could find). The PSU is 12V. Use a DC-DC converter 12V-5V.

cat /sys/kernel/debug/usb/devices

T:  Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480  MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0002 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ehci_hcd
S:  Product=EHCI Host Controller
S:  SerialNumber=101c0000.ehci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms

T:  Bus=02 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12   MxCh= 1
B:  Alloc=  0/900 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0001 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ohci_hcd
S:  Product=Generic Platform OHCI controller
S:  SerialNumber=101c1000.ohci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   2 Ivl=255ms

T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  3 Spd=12   MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1307 ProdID=0163 Rev= 1.00
S:  Manufacturer=USBest Technology
S:  Product=USB Mass Storage Device
S:  SerialNumber=0812179677809a
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr= 80mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
E:  Ad=01(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=  64 Ivl=8ms

Let's see...

3 Likes

USB 2.0 Working

[  987.617361] usb 1-1: new high-speed USB device number 7 using ehci-platform
[  988.007388] usb 1-1: reset high-speed USB device number 7 using ehci-platform
[  988.269704] r8152 1-1:1.0: load rtl8153a-3 v2 02/07/20 successfully
[  988.339319] r8152 1-1:1.0 eth1: v1.12.13

root@OWRT_AC1200:/# lsusb -t
/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=ohci-platform/1p, 12M
/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=ehci-platform/1p, 480M
    |__ Port 1: Dev 7, If 0, Class=, Driver=r8152, 480M
root@OWRT_AC1200:/# cat /sys/kernel/debug/usb/devices

T:  Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480  MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0002 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ehci_hcd
S:  Product=EHCI Host Controller
S:  SerialNumber=101c0000.ehci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  7 Spd=480  MxCh= 0
D:  Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  2
P:  Vendor=13b1 ProdID=0041 Rev=30.00
S:  Manufacturer=Linksys
S:  Product=Linksys USB3GIGV1
S:  SerialNumber=000001000000
C:* #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=180mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=00 Driver=r8152
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=   2 Ivl=16ms
C:  #Ifs= 2 Cfg#= 2 Atr=a0 MxPwr=180mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=
E:  Ad=83(I) Atr=03(Int.) MxPS=  16 Ivl=16ms
I:  If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

T:  Bus=02 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12   MxCh= 1
B:  Alloc=  0/900 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0001 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ohci_hcd
S:  Product=Generic Platform OHCI controller
S:  SerialNumber=101c1000.ohci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   2 Ivl=255ms

1 Like

USB Working and stable.

Remove the 1K resistors connected to GND

Solder 15K resistors to GND from D+ and D-

12V/5V DC-DC converter installed in the PSU

Modded case, reused USB connector from the DC-DC converter

Completed:

Output:

root@OWRT_AC1200:~# lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux 5.15.127 ehci_hcd EHCI Host Controller
Bus 002 Device 002: ID 0fe6:9700  USB 2.0 10/100M Ethernet Adaptor
Bus 002 Device 001: ID 1d6b:0001 Linux 5.15.127 ohci_hcd Generic Platform OHCI controller
root@OWRT_AC1200:~# dmesg | grep usb
[    4.316960] usbcore: registered new interface driver usbfs
[    4.322786] usbcore: registered new interface driver hub
[    4.328301] usbcore: registered new device driver usb
[    4.398579] phy phy-10120000.usbphy.0: remote usb device wakeup disabled
[    4.405431] phy phy-10120000.usbphy.0: UTMI 16bit 30MHz
[    4.634889] usbcore: registered new interface driver usb-storage
[    4.644482] usbcore: registered new interface driver uas
[    5.300247] usb 2-1: new full-speed USB device number 2 using ohci-platform
[   14.492937] hso: drivers/net/usb/hso.c: Option Wireless
[   14.498469] usbcore: registered new interface driver hso
[   14.643233] usbcore: registered new interface driver r8152
[   14.654342] usbcore: registered new interface driver ums-alauda
[   14.665616] usbcore: registered new interface driver ums-cypress
[   14.675148] usbcore: registered new interface driver ums-datafab
[   14.686023] usbcore: registered new interface driver ums-freecom
[   14.695495] usbcore: registered new interface driver ums-isd200
[   14.706332] usbcore: registered new interface driver ums-jumpshot
[   14.717521] usbcore: registered new interface driver ums-karma
[   14.727296] usbcore: registered new interface driver ums-sddr09
[   14.738592] usbcore: registered new interface driver ums-sddr55
[   14.748259] usbcore: registered new interface driver ums-usbat
[   14.765607] usbcore: registered new interface driver asix
[   14.775399] usbcore: registered new interface driver ax88179_178a
[   14.786844] usbcore: registered new interface driver cdc_ether
[   14.813362] usbcore: registered new interface driver cdc_ncm
[   14.822131] usbcore: registered new interface driver cdc_subset
[   14.930242] dm9601 2-1:1.0 eth1: register 'dm9601' at usb-101c1000.ohci-1, Davicom DM96xx USB 10/100 Ethernet, 00:e0:xx:xx:xx:xx
[   14.942316] usbcore: registered new interface driver dm9601
root@OWRT_AC1200:~#  cat /sys/kernel/debug/usb/devices

T:  Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480  MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0002 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ehci_hcd
S:  Product=EHCI Host Controller
S:  SerialNumber=101c0000.ehci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms

T:  Bus=02 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12   MxCh= 1
B:  Alloc=  0/900 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0001 Rev= 5.15
S:  Manufacturer=Linux 5.15.127 ohci_hcd
S:  Product=Generic Platform OHCI controller
S:  SerialNumber=101c1000.ohci
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   2 Ivl=255ms

T:  Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12   MxCh= 0
D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=0fe6 ProdID=9700 Rev= 1.01
S:  Product=USB 2.0 10/100M Ethernet Adaptor
C:* #Ifs= 1 Cfg#= 1 Atr=a0 MxPwr=120mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=00(>ifc ) Sub=00 Prot=00 Driver=dm9601
E:  Ad=81(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=83(I) Atr=03(Int.) MxPS=   8 Ivl=1ms
root@OWRT_AC1200:~#

2 Likes

Thanks
I am managed to install breed.
with mtd write command.