Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit) -- fully supported and flashable with OpenWRTInvasion

You more than likely need to force the system update manually over CLI because of the model name changes.

Can you share with us the proces where to download and how to go true? Do we need any hardware gadgets?

You can find the procedure in the first post of this thread, but basically you need to dump the SPI flash, modify a few bytes then write it. You need a CH341A programmer with a SOIC8 clamp (you can easily find them online for cheap)

So as I understand "rogerpueyo" explained

I have bayed - CH341A programmer with a SOIC8 clamp understand how to get inside the FLASH memory then Dumping the SPI FLASH memory > Extracting the SPI FLASH memory content using binwalk > Modifying the U-Boot bootloader timeout > then what is next step .. Thanks for help :slight_smile:

can anyone make a full guide on flashing it via the CH341A. Thinking of buying a CH341A, found one that is bundled with a SOIC8 clamp.

Hi,

Once you have the CH341A programmer and the SOIC8 clamp, you have to dump the content of the SPI memory to your computer. I used the ch341prog tool. You may want to dump it a couple of times and check you got the same exact dump by calculating its MD5 or SHA1 checksum.

I used binwalk to inspect the different partitions in the flash dump and their content, but this step is not actually necessary so you can skip it.

To modify the bootloader, I opened the SPI memory dump with the Bless tool. The changes to be made are detailed in the first post (namely, replace the "bootdelay...off" part at 0x19690 with "bootdelay.....5", keeping the length of the text the same).

With the modified memory dump, it's time to write it back to the router, with the same ch341prog tool.
After this, the U-Boot bootloader can be stopped with a keystroke via the serial console and an InitramFS can be booted.

i use with Windows AsProgrammer_1.4.1

Has anyone tried to compile an image for 4a in branch 19.07:?
I try but there is something wrong:

uner branch 19.07 kernel don't see spi flash:

MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
[ 9.842946] Enable NFI Clock
[ 9.845817] # MTK NAND # : Use HW ECC
[ 9.849476] Device not found, ID: f0f0
[ 9.853222] Not Support this Device!
[ 9.856950] chip_mode=00000002
[ 9.859987] Support this Device in MTK table! f0f0
[ 9.864963] [NAND]select ecc bit:4, sparesize :64 spare_per_sector=16
[ 9.871438] nand: device found, Manufacturer ID: 0xf0, Chip ID: 0xf0
[ 9.877759] nand: Unknown MT7621-NAND
[ 9.881421] nand: bus width 8 instead of 16 bits
[ 9.886013] nand: No NAND device found
[ 9.889739] # MTK NAND # : nand_scan fail.
[ 9.893827] [NFI] mtk_nand_probe fail, err = -6!

under master is all ok:

MediaTek Nand driver init, version v2.1 Fix AHB virt2phys error
[ 2.490962] spi-mt7621 1e000b00.spi: sys_freq: 220000000
[ 2.498986] m25p80 spi0.0: gd25q128 (16384 Kbytes)

I use both dts file - 4a Gigabyte version and 3gv2, all work as above :frowning:

Didn't try it but have been thinking of trying it out but now I rather keep my router running on snapshots until it's officialy supported. I'm also not familiar with how commits go to stable branches. For example: "Are they maybe cherry picked?". It would be great though to have this change being pulled into the official repository. @rogerpueyo: Could you make a pull request to the openwrt master? I think it would be bad if someone else took credit on this.

Please check https://github.com/openwrt/openwrt/pull/2486 :slight_smile:

1 Like

That's great! Thank you for all the effort. :smiley:

I can confirm that the image from @Gingernut (https://drive.google.com/file/d/1-CYRstTZoUlPlOZg7_T5YJV762txHWJp/view?usp=drivesdk)
works with the A4 Gigabit Edition, which I accidentally treated as 3Gv2, but hey: everything worked just fine.
What's missing are the settings for the LEDs.

I've pulled that build, it was acting up due to some toolchain optimizations I added but are now removed, and uploaded a more recent one.

You might need to force flash it, not sure

https://drive.google.com/folderview?id=1VafI6QbULi5tM8siIFj0uucBRNhiAd-A

1 Like

The image works, but it looks like the MAC-addresses of the wifi-interfaces are similar on all devices:
radio0: EC4118C8D42E
radio1: EC4118C8D42F

As anyone else facing the same problem?

They are similar but not the same, they have a one bit difference, E and the other F.

Anyone have a clue why I get this?

I meant that both of my routers have the same Mac addresses in wifi0, wifi1 and erh0.
Two routers - same Mac. This will break any network.
Are you experience the same problem?

I only have one so I don't get this problem.

The MAC address is extacted from the flash then one bit is changed for each interface so they shouldn't be the same on two different devices.

Mine are:
radio0: EC:41:18:C4:79:0E
radio1: EC:41:18:C4:79:0F

Following this thread it seems that the MAC address is stored in the u-boot environment. If you written the same image to both routers with your flash programmer, they will get the same MAC address. You are supposed to extract-modify-write the image from each router to retain the MAC address setting. Could this be the cause?

There is also a normal_firmware_md5= and a SN= setting.

1 Like

could anyone dump the content of th flash-chip and upload the file here, please?
I need it is a master to modify the mac adresses AND the model.
In my dumb I can get the mac fixed, but the model is set to r3gv2 and I cannot set it to r4a, which is shorter (don't know how to use a hex editor properly).
@rogerpueyo: can I get your dump, please?