Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit) -- fully supported and flashable with OpenWRTInvasion

yabba235 · 2019-11-09T16:26:19.482Z

Don't use breed bootloader for this router - breed is not optimizing for this hw - has wrong build partition table - is good for padavan, not for openwrt :).
Breed is only helpes for backup eeprom partiton (art)
I now working for uboot mod for this model with simple web console.
For now in test i can upload uboot and firmware file with success.
Both files get from backup page from luci ( openwrt 19.7 xiaomi 4a version ).
If any test pass I share this uboot mod

Gingernut · 2019-11-09T18:16:14.873Z

I had read that somewhere.

semuut · 2019-11-26T01:22:00.011Z

How to flash this from the original firmware?? just using upgrade system or how ?

bill888 · 2019-11-26T18:20:22.307Z

Please refer to very first post in this long thread for instructions. You will need a SPI flash programmer.

meyoufor2 · 2019-11-28T08:01:15.109Z

I have read the full instruction but I am missing information's because they change over the full course of posts... updated and so on... can someone write the latest newest instructions...
1.Buy SPI flash programmer with SPI clamp
2.Connect TXD, RXD and GND pins on USB programer, to (respectively) the RXD, TXD and GND UART pins on the router's board
3... I have come to this more I did not had time to go forward...

I would be weary thankful for one that successfully programed router to write more... Thank you all

Double-G · 2019-11-28T08:39:25.989Z

you cannot demand that, you need to do a little work yourself. Maybe this explanation will help you, that's the way I flashed the 4A.

tmomas · 2019-11-28T11:27:02.843Z

meyoufor2:

I have read the full instruction but I am missing information's because they change over the full course of posts... updated and so on... can someone write the latest newest instructions...

The OpenWrt wiki would be the place to put any installation instructions.
-> https://openwrt.org/toh/xiaomi/mir3g

Although MIR3G and 4A have similarities, a separate page for the 4A would make things a bit clearer for the 4A users, IMHO.

franz3x8 · 2019-11-29T03:45:01.518Z

true hahaha, someone should create a 4A page.

bill888 · 2019-11-29T10:28:00.121Z

fwiw

https://openwrt.org/inbox/toh/xiaomi/xiaomi_mi_router_4a_gigabit_edition

daniel-dona · 2019-12-12T22:11:46.280Z

First of all, thanks to everyone for the work done with this router.

I successfully flashed the SPI NOR chip (after a couple of pitfalls) and I now have OpenWRT running in the router, everything seems to work fine except the 5G WiFi chip.

The tx power seems ridiculously low and I have no option to change it. The working range is about 5 meters, the shown power is 3 dBm

root@OpenMi:~# iw wlan1 info
Interface wlan1
	ifindex 23
	wdev 0x100000002
	addr *****
	ssid OpenWrt
	type AP
	wiphy 1
	channel 108 (5540 MHz), width: 80 MHz, center1: 5530 MHz
	txpower 3.00 dBm

Wiphy phy1
	max # scan SSIDs: 4
	max scan IEs length: 2247 bytes
	max # sched scan SSIDs: 0
	max # match sets: 0
	max # scan plans: 1
	max scan plan interval: -1
	max scan plan iterations: 0
	Retry short limit: 7
	Retry long limit: 4
	Coverage class: 0 (up to 0m)
	Available Antennas: TX 0x3 RX 0x3
	Configured Antennas: TX 0x3 RX 0x3
	Supported interface modes:
		 * IBSS
		 * managed
		 * AP
		 * AP/VLAN
		 * monitor
		 * mesh point
	Band 2:
		Capabilities: 0x1ff
			RX LDPC
			HT20/HT40
			SM Power Save disabled
			RX Greenfield
			RX HT20 SGI
			RX HT40 SGI
			TX STBC
			RX STBC 1-stream
			Max AMSDU length: 3839 bytes
			No DSSS/CCK HT40
		Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
		Minimum RX AMPDU time spacing: 4 usec (0x05)
		HT TX/RX MCS rate indexes supported: 0-15
		VHT Capabilities (0x318001b0):
			Max MPDU length: 3895
			Supported Channel Width: neither 160 nor 80+80
			RX LDPC
			short GI (80 MHz)
			TX STBC
			RX antenna pattern consistency
			TX antenna pattern consistency
		VHT RX MCS set:
			1 streams: MCS 0-9
			2 streams: MCS 0-9
			3 streams: not supported
			4 streams: not supported
			5 streams: not supported
			6 streams: not supported
			7 streams: not supported
			8 streams: not supported
		VHT RX highest supported: 0 Mbps
		VHT TX MCS set:
			1 streams: MCS 0-9
			2 streams: MCS 0-9
			3 streams: not supported
			4 streams: not supported
			5 streams: not supported
			6 streams: not supported
			7 streams: not supported
			8 streams: not supported
		VHT TX highest supported: 0 Mbps
		Frequencies:
			* 5180 MHz [36] (3.0 dBm)
			* 5200 MHz [40] (3.0 dBm)
			* 5220 MHz [44] (3.0 dBm)
			* 5240 MHz [48] (3.0 dBm)
			* 5260 MHz [52] (3.0 dBm) (radar detection)
			* 5280 MHz [56] (3.0 dBm) (radar detection)
			* 5300 MHz [60] (3.0 dBm) (radar detection)
			* 5320 MHz [64] (3.0 dBm) (radar detection)
			* 5500 MHz [100] (3.0 dBm) (radar detection)
			* 5520 MHz [104] (3.0 dBm) (radar detection)
			* 5540 MHz [108] (3.0 dBm) (radar detection)
			* 5560 MHz [112] (3.0 dBm) (radar detection)
			* 5580 MHz [116] (3.0 dBm) (radar detection)
			* 5600 MHz [120] (3.0 dBm) (radar detection)
			* 5620 MHz [124] (3.0 dBm) (radar detection)
			* 5640 MHz [128] (3.0 dBm) (radar detection)
			* 5660 MHz [132] (3.0 dBm) (radar detection)
			* 5680 MHz [136] (3.0 dBm) (radar detection)
			* 5700 MHz [140] (3.0 dBm) (radar detection)
			* 5745 MHz [149] (3.0 dBm)
			* 5765 MHz [153] (3.0 dBm)
			* 5785 MHz [157] (3.0 dBm)
			* 5805 MHz [161] (3.0 dBm)
			* 5825 MHz [165] (3.0 dBm)
	valid interface combinations:
		 * #{ IBSS } <= 1, #{ managed, AP, mesh point } <= 8,
		   total <= 8, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz }

	HT Capability overrides:
		 * MCS: ff ff ff ff ff ff ff ff ff ff
		 * maximum A-MSDU length
		 * supported channel width
		 * short GI for 40 MHz
		 * max A-MPDU length exponent
		 * min MPDU start spacing
	Supported extended features:
		* [ VHT_IBSS ]: VHT-IBSS
		* [ RRM ]: RRM
		* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
		* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
		* [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
		* [ AIRTIME_FAIRNESS ]: airtime fairness scheduling

Also, I don't now if I broke something else while flashing, I tried several of the sysupgrade binaries in this thread and only this (Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit): fully supported but requires overwriting SPI flash with programmer) worked.

I also found this line in the kernel log:

[   13.190730] mt76x2e 0000:01:00.0: ASIC revision: 76120044
>> [   13.197230] mt76x2e 0000:01:00.0: EEPROM data check failed: ffff
[   13.836361] mt76x2e 0000:01:00.0: Invalid MAC address, using random address 92:fa:ea:2e:a7:4f
[   13.866918] mt76x2e 0000:01:00.0: ROM patch build: 20141115060606a
[   13.876550] mt76x2e 0000:01:00.0: Firmware Version: 0.0.00
[   13.882028] mt76x2e 0000:01:00.0: Build: 1
[   13.886102] mt76x2e 0000:01:00.0: Build Time: 201507311614____
[   13.906349] mt76x2e 0000:01:00.0: Firmware running!

Gingernut · 2019-12-13T06:21:18.644Z

I'd suggest to install the latest snapshot, it doesn't have LUCI by default, and see if the problem persists.

daniel-dona · 2019-12-13T09:50:20.345Z

I also tried to flash other images for the R3Gv2, but all ended in a kernel panic. I don't have the bootlogs right now but I could try to replicate this weekend. I thought the hardware was identical...

Lucky1 · 2019-12-13T11:01:01.161Z

I don't have this router but I think maybe you have erased you factory/ART partition
I hope you made a copy of the flash before you programed something else into it
your factory/ART contains all the factory calibrations for you device wifi being the important one
as well as MAC addresses and any other thing else the manufacturer needed
so look at restoring or at lest checking your ART data
if you have lost it the best you can do is clone another board but good luck it will never be the same
first thing you can check is to see if the MAC addresses are correct with the case sticker it may give you a quick indication to see if they have been erased or not

daniel-dona · 2019-12-14T11:06:12.039Z

I don't know which of this is the ART/calibration/whatever partition. And yes, probably erased by mistake that information, and no, I don't have a backup of the whole chip (my mistake), just of the bootloader...

¿But are really this cheap devices calibrated one by one in the factory? Hard to believe... Maybe I could get it from others dump, change the MACs and cross fingers...

[    2.502544] 8 fixed-partitions partitions found on MTD device spi0.0
[    2.508897] Creating 8 MTD partitions on "spi0.0":
[    2.513674] 0x000000000000-0x000000030000 : "Bootloader"
[    2.520148] 0x000000030000-0x000000040000 : "Config"
[    2.526219] 0x000000040000-0x000000050000 : "Bdata"
[    2.532238] 0x000000050000-0x000000060000 : "Factory"
[    2.538443] 0x000000060000-0x000000070000 : "crash"
[    2.544413] 0x000000070000-0x000000080000 : "cfg_bak"
[    2.550612] 0x000000080000-0x000000180000 : "overlay"
[    2.556800] 0x000000180000-0x000000e80000 : "firmware"
[    2.563275] 2 uimage-fw partitions found on MTD device firmware
[    2.569210] Creating 2 MTD partitions on "firmware":
[    2.574161] 0x000000000000-0x0000001ec0c7 : "kernel"
[    2.580262] 0x0000001ec0c7-0x000000d00000 : "rootfs"
[    2.586256] mtd: device 9 (rootfs) set to be root filesystem
[    2.592027] 1 squashfs-split partitions found on MTD device rootfs
[    2.598225] 0x000000530000-0x000000d00000 : "rootfs_data"

daniel-dona · 2019-12-14T13:40:20.978Z

Ok ok ok, I think I fixed the mess, the backup of the bootloader I made was from 0x000000 to 0x080000 so it included the Factory partition.

From the u-boot command line I copied the binary data to the SPI chip using

spi write 5XXXX [DATA AS ASCII]

A little pain in the ass to do it manually but, I worked!

Lucky1 · 2019-12-14T19:40:03.979Z

¿But are really this cheap devices calibrated one by one in the factory? Hard to believe...
I'm only guessing in this case but other electronics I have working with
yes each is done one at a time
put board in test jig
it injects software calibrates & test all in one
the only way to get new calibration data
is to run it through the process again

Double-G · 2019-12-14T21:06:33.872Z

My router's 5Ghz-Wifi crashed several times.
I'm using SNAPSHOT r11583-68fb38548b which is Gingernut's latest firmware.

Log:

Sat Dec 14 21:55:42 2019 daemon.info hostapd: wlan1: STA 4c:56:9d:85:94:ff IEEE 802.11: disassociated due to inactivity
Sat Dec 14 21:55:43 2019 daemon.info hostapd: wlan1: STA 4c:56:9d:85:94:ff IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
Sat Dec 14 21:56:26 2019 daemon.notice hostapd: wlan1: DFS-RADAR-DETECTED freq=5260 ht_enabled=0 chan_offset=0 chan_width=3 cf1=5290 cf2=0
Sat Dec 14 21:56:26 2019 daemon.notice hostapd: wlan1: DFS-NEW-CHANNEL freq=5745 chan=149 sec_chan=1
Sat Dec 14 21:56:26 2019 daemon.info hostapd: wlan1: IEEE 802.11 driver starting channel switch: freq=5745, ht=1, vht_ch=0x0, offset=1, width=3 (80 MHz), cf1=5775, cf2=0
Sat Dec 14 21:56:26 2019 daemon.notice hostapd: wlan1: CTRL-EVENT-STARTED-CHANNEL-SWITCH freq=5745 ht_enabled=1 ch_offset=1 ch_width=80 MHz cf1=5775 cf2=0 dfs=0
Sat Dec 14 21:56:27 2019 daemon.info hostapd: wlan1: IEEE 802.11 driver had channel switch: freq=5745, ht=1, vht_ch=0x0, offset=1, width=3 (80 MHz), cf1=5775, cf2=0
Sat Dec 14 21:56:27 2019 daemon.notice hostapd: wlan1: CTRL-EVENT-CHANNEL-SWITCH freq=5745 ht_enabled=1 ch_offset=1 ch_width=80 MHz cf1=5775 cf2=0 dfs=0
Sat Dec 14 21:56:27 2019 daemon.notice hostapd: wlan1: AP-CSA-FINISHED freq=5745 dfs=0
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.515990] ------------[ cut here ]------------
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.520897] WARNING: CPU: 2 PID: 19 at backports-5.4-rc8-1/net/mac80211/tx.c:4308 ieee80211_ctstoself_get+0x314/0x330 [mac80211]
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.532544] Modules linked in: pppoe ppp_async pppox ppp_generic nf_conntrack_ipv6 mt76x2e mt76x2_common mt76x02_lib mt7603e mt76 mac80211 iptable_nat ipt_REJECT ipt_MASQUERADE cfg80211 xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_recent xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_hl xt_helper xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_TCPMSS xt_REDIRECT xt_LOG xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CT xt_CLASSIFY wireguard slhc nf_reject_ipv4 nf_nat_redirect nf_nat_masquerade_ipv4 nf_conntrack_ipv4 nf_nat_ipv4 nf_nat nf_log_ipv4 nf_flow_table_hw nf_flow_table nf_defrag_ipv6 nf_defrag_ipv4 nf_conntrack_rtcache nf_conntrack_netlink iptable_raw iptable_mangle iptable_filter ipt_ECN ip_tables crc_ccitt compat sch_cake act_ctinfo act_connmark nf_conntrack
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.603679]  sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_tcindex cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 ifb ip6_udp_tunnel udp_tunnel leds_gpio gpio_button_hotplug
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.658123] CPU: 2 PID: 19 Comm: ksoftirqd/2 Tainted: G        W       4.14.155 #0
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.665750] Stack : 00000000 858a1bb0 87198c00 800774b4 805f0000 80591ae4 00000000 00000000
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.674175]         8055c224 87c89bcc 87c7908c 805cc9e7 80556fb0 00000001 87c89b70 1cc2827b
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.682600]         00000000 00000000 80740000 00000000 807384a0 00000154 00000008 00000000
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.691026]         00000000 00000000 000a0acb 20202020 00000000 805f0000 00000000 869adfa8
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.699449]         869ec6a0 000010d4 87e18480 858a1bb0 00000010 802d0400 00000008 80730008
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.707874]         ...
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.710401] Call Trace:
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.712948] [<8000c4d4>] show_stack+0x58/0x100
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.717490] [<804932f4>] dump_stack+0xa4/0xe0
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.721924] [<8002fd10>] __warn+0xe0/0x140
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.726094] [<8002f9b4>] warn_slowpath_null+0x1c/0x28
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.731324] [<869adfa8>] ieee80211_ctstoself_get+0x314/0x330 [mac80211]
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.738039] [<80150015>] path_lookupat+0x51/0x23c
Sat Dec 14 21:56:27 2019 kern.warn kernel: [513457.742961] ---[ end trace 352621395b434168 ]---
Sat Dec 14 21:56:42 2019 daemon.notice hostapd: wlan1: AP-STA-DISCONNECTED b0:6f:xx:xx:xx

slh · 2019-12-14T21:52:09.821Z

Lucky1:

¿But are really this cheap devices calibrated one by one in the factory? Hard to believe...

Some projects with large device deployments (e.g. freifunk.net) have checked this for their cheap TP-Link TL-WR841N (and other) devices, within multiple thousands of devices there were only a handful with identical ART partitions (these devices have a fake/ static MAC address in their calibration data, taking the real MAC from uboot-env, so they're really only comparing wifi calibration data here).

Looking into the calibration data itself (and comparing it between a couple of devices I have sitting around) also shows that there are correction deltas for multiple frequencies at multiple temperature points, also suggesting that the manufacturers really (have to-) do proper per-device calibration. Especially for 802.11ac and 5 GHz in particular this calibration needs to be exact, to offset production variances.

franz3x8 · 2019-12-15T04:13:46.092Z

also experiencing this.

Double-G · 2019-12-15T07:47:55.696Z

Frustrating, I also overwrote my firmware without backing it up first. Well as these calibrations are most probably of minor relevance, I won't be that frustrated..
At least my device seems to be running pretty well in terms of speed and performance over distance.
If we can fix hostapd's crashes on 5Ghz, I'll be pretty happy with the device anyway.