Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit) -- fully supported and flashable with OpenWRTInvasion

mircam · 2020-12-16T22:10:44.030Z

I just flash stock firmware and differences in speed and stability are huge.
Cpu load is much smaller with traffic at full speed. The main advantage: there are no errors or resets:

root@XiaoQiang:~# cat /proc/interrupts
           CPU0       CPU1       CPU2       CPU3
  3:          3    4164499          0          0  MIPS GIC  eth0
  4:          0          0     714439          0  MIPS GIC  wl0
  7:     197579     197495     197532     197533  MIPS GIC  timer
 11:          0          0          0          0  MIPS GIC  HS_DMA
 12:          0          0          0          0  MIPS GIC  ralink_gpio
 23:          3          0          0          0  MIPS GIC  Ralink_ESW
 26:        227          0          0          0  MIPS GIC  serial
 56:       9049          0          0          0  MIPS GIC  IPI_resched
 57:          0       9441          0          0  MIPS GIC  IPI_resched
 58:          0          0       7601          0  MIPS GIC  IPI_resched
 59:          0          0          0       9623  MIPS GIC  IPI_resched
 60:      41645          0          0          0  MIPS GIC  IPI_call
 61:          0      29443          0          0  MIPS GIC  IPI_call
 62:          0          0      46732          0  MIPS GIC  IPI_call
 63:          0          0          0      42637  MIPS GIC  IPI_call
ERR:          0

ulpian · 2020-12-16T22:24:44.682Z

Wow! Nice project well done my friend.

I didn't even know that such a cable existed. If we use such a cable with a decent modern powerbank (which supports pd or qc 3.0 and pass-through charging of course), will it act as a kind of UPS in case of power failure? Thank you. Have a nice day!
ulpian

markky · 2020-12-17T03:56:55.584Z

remlei:

I think the 4A 100M only works currently for Chinese version of the router, not the global version. there's some sort of nvram related things need to be done on global version for the openwrt firmware to work.

Well, if someone has the cn version to compare to, this is nvram show on an int r4ac running 3.0.5

bootcmd=tftp
bootdelay=5
ethaddr="00:AA:BB:CC:DD:20"
ipaddr=192.168.31.1
serverip=192.168.31.100
ssh_en=0
flag_boot_type=2
SN=XXXXX/XXXXXXXXX
uart_en=0
telnet_en=0
flag_ota_reboot=0
wl0_ssid=Xiaomi_XXXX_XXXX_5G
wl1_ssid=Xiaomi_XXXX_XXXX
wl0_radio=1
wl1_radio=1
model=R4AC
boot_wait=off
mode=Router
CountryCode=XX
ColorType=101
color=101
nv_wan_type=dhcp
nv_device_id=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
nv_channel_secret=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=
flag_boot_success=1
flag_try_sys1_failed=0
flag_try_sys2_failed=0
flag_last_success=0
version=3.0.5
Router_unconfigured=0
nv_sys_pwd=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
nv_wifi_ssid=Xiaomi_XXXX
nv_wifi_enc=mixed-psk
nv_wifi_pwd=XXXXXXXXXX
nv_wifi_ssid1=Xiaomi_XXXX_5G
nv_wifi_enc1=mixed-psk
nv_wifi_pwd1=XXXXXXXXXX
restore_defaults=0
stdin=serial
stdout=serial
stderr=serial
flag_boot_rootfs=0

Looking around at the various shell scripts in the original firmware, I think recovery_info_sync.sh is interesting - it would seem there's info sent back home after a recovery. Check out the wget. I've monitored normal boot activity and there's an awful lot of queries sent before the router comes online with the standard firmware.

I also noted in the past couple of days that whilst running the standard firmware, the router was attempting to perform a mitm ssl attack using a certificate my browser didn't trust. I definitely want to replace the stock firmware with openwrt, I simply don't trust the default firmware.

Mark

sapkra · 2020-12-17T05:36:23.473Z

Great idea - I cannot think of a reason why it wouldn't work.

Kaan · 2020-12-17T15:36:23.188Z

@db260179 Hi, been running your firmware since you released it and it's been rock solid so far.
I've just noticed that my ERR was quite high and it increased every couple of seconds when I was streaming games from my computer to my VR headseat. About 90 mbit between ETH and 5ghz wifi.

I don't know what the significance of ERR is but I thought you should know. (and because of this I don't know how it was in stock or snapshot firmware either.)

db260179 · 2020-12-17T17:09:47.980Z

So the ERR are due to the wifi dma not processing correctly. Only the oem driver has some sort of proper dma magic going on, the new napi threaded has helped a little, not much to worry about.

I'm guessing your switch is stable? there will be a new stable coming soon. updated wifi crda and kernel to 4.14.212

Kaan · 2020-12-17T17:22:20.721Z

db260179:

I'm guessing your switch is stable?

As far as I can tell yes, today the router crashed and I couldn't access it via ethernet or wifi. I was messing with so many packages and kmods that I thought it was me that caused it.

May I ask what ERR means exactly? For example, would it cause stutters in stream while I was playing. (I do have rare stutters but can't pinpoint the cause.)

db260179 · 2020-12-17T19:35:54.997Z

unix.stackexchange.com

Regarding /proc/interrupts what are MIS and ERR?

linux, proc, interrupt

asked by Matthew on 12:15AM - 17 Mar 18 UTC

Reverse engineering oem drivers is a complicated business, openwrt devs have done well to get this far.

db260179 · 2020-12-18T09:37:42.524Z

So anyone who has the xiaomi 4A gigabit model with transmit timeout issues?

Feel free to try this image:

Test R4AG transmit timeout test image

When testing can you do a:

Run iperf3 -s in the ssh terminal on the router

Then on your pc/laptop that has iperf3 tool:

iperf3 -c 192.168.1.1 -u -t 100 -b 1000M -P 2

Feedback packet loss and interruptions.

Also from the dmesg:

grep "gsw: chip rev"

This gives me an indication of the revision model of MT7621 SOC version, you have that is problematic.

aelitasch · 2020-12-18T10:09:01.115Z

Hi, can someone help me to unbrick mi router 4a gigabit? the problem occurs when i tried to flash stock firmware from openwrt without factory reset, and for info i use Hoddy debrick Method to flash from openwrt snapshot to mi wifi firmware, when i try to flash with tinypxe, it success, the router blinks blue led, but after i reboot the router (re-plug the power) my router keep restarting for every 5 seconds,
i know it is bootlooping because the wifi signal appear and the lan is connected but i cant access 192.168.31.1 and also when i tried to ping 192.168.31.1 it replies but after 5 seconds it says request timeout and destination network unreachable,
also i've tried to disasembly the router and use serial port to see the boot log, and there's an error line that says :

Fri Jun 28 11:32:22 CST 2019 boot_check[3475]: ERROR: KEY SERVICE FAILED: EXITCODE=1;ESP=1;LIMIT=65;CMD=/etc/rc.d/S21sysapihttpd;ARG=boot;
Fri Jun 28 11:32:22 CST 2019 boot_check[3475]: ERROR: 1 KEY SERVICE FAILED.
Fri Jun 28 11:32:22 CST 2019 boot_check[3475]: Try rebooting system to recover.
[   31.160000] MT7612E cleanup
[   31.160000] ipaccount: ifname [apclii0] event[6]
[   31.160000] *hwnat unreg dev ******* unset dev[apclii0]:14
[   31.220000] ipaccount: ifname [apclii0] event[17]
[   31.220000] RtmpOSNetDevDetach(): RtmpOSNetDeviceDetach(), dev->name=wl0!
[   31.230000] ipaccount: ifname [wl0] event[9]
[   31.260000] br-lan: port 3(wl0) entered disabled state
[   31.270000] ipaccount: ifname [wl0] event[2]
[   31.270000] *hwnat unreg dev ******* unset dev[wl0]:9
[   31.280000] device wl0 left promiscuous mode
[   31.280000] br-lan: port 3(wl0) entered disabled state
[   31.290000] ipaccount: ifname [wl0] event[6]
[   31.350000] ipaccount: ifname [wl0] event[17]
[   31.350000] Restarting system.
[   31.360000] wdg reset
[   31.360000] try_freeze_spic: waiting bbu spic to calm down.
[   31.360000] try_freeze_spic: GPIOMODE=0x000405A8
[   31.370000] try_freeze_spic: set spi pin to gpio mode.
[   31.370000] try_freeze_spic: GPIOMODE=0x000505A8
[   31.450000] jffs2: Unknown node type for REF_PRISTINE node at 0x000a706c: 0x0000
[   31.510000] jffs2: Unknown node type for REF_PRISTINE node at 0x000a7110: 0x0000
[   31.680000] jffs2: Unknown node type for REF_PRISTINE node at 0x000a7210: 0x0000
[   31.890000] normal reset

===================================================================
                MT7621   stage1 code Oct 28 2018 20:39:32 (ASIC)
                CPU=500000000 HZ BUS=166666666 HZ
==================================================================
Change MPLL source from XTAL to CR...
do MEMPLL setting..
MEMPLL Config : 0x11100000
3PLL mode + External loopback
=== XTAL-40Mhz === DDR-1200Mhz ===
PLL3 FB_DL: 0x3, 1/0 = 522/502 0D000000
PLL4 FB_DL: 0xa, 1/0 = 686/338 29000000
PLL2 FB_DL: 0x10, 1/0 = 583/441 41000000
do DDR setting..[01F40000]
Apply DDR3 Setting...(use customer AC)
          0    8   16   24   32   40   48   56   64   72   80   88   96  104  112  120
      --------------------------------------------------------------------------------
0000:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0001:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0002:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0003:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0004:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0005:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0006:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0007:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0008:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0009:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
000D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    1
000E:|    0    0    0    0    0    0    0    0    0    1    1    1    1    1    1    1
000F:|    0    0    0    0    1    1    1    1    1    1    1    1    1    1    0    0
0010:|    1    1    1    1    1    1    1    1    1    0    0    0    0    0    0    0
0011:|    1    1    1    0    0    0    0    0    0    0    0    0    0    0    0    0
0012:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0013:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0014:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0015:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0016:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0017:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0018:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
0019:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001A:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001B:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001C:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001D:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001E:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
001F:|    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0    0
DRAMC_DQSCTL1[0e0]=13000000
DRAMC_DQSGCTL[124]=80000033
rank 0 coarse = 15
rank 0 fine = 72
B:|    0    0    0    0    0    0    0    0    0    0    1    1    1    0    0    0
opt_dle value:11
DRAMC_DDR2CTL[07c]=C287223D
DRAMC_PADCTL4[0e4]=000022B3
DRAMC_DQIDLY1[210]=0C090A09
DRAMC_DQIDLY2[214]=06090908
DRAMC_DQIDLY3[218]=0A070606
DRAMC_DQIDLY4[21c]=08060B07
DRAMC_R0DELDLY[018]=00001F20
==================================================================
                RX      DQS perbit delay software calibration
==================================================================
1.0-15 bit dq delay value
==================================================================
bit|     0  1  2  3  4  5  6  7  8  9
--------------------------------------
0 |    8 8 8 11 6 8 8 6 4 5
10 |    7 8 6 9 6 7
--------------------------------------

==================================================================
2.dqs window
x=pass dqs delay value (min~max)center
y=0-7bit DQ of every group
input delay:DQS0 =32 DQS1 = 31
==================================================================
bit     DQS0     bit      DQS1
0  (1~62)31  8  (1~58)29
1  (1~60)30  9  (1~59)30
2  (1~61)31  10  (1~61)31
3  (1~62)31  11  (1~58)29
4  (1~60)30  12  (1~60)30
5  (1~62)31  13  (1~58)29
6  (1~62)31  14  (1~61)31
7  (1~63)32  15  (1~60)30
==================================================================
3.dq delay value last
==================================================================
bit|    0  1  2  3  4  5  6  7  8   9
--------------------------------------
0 |    9 10 9 12 8 9 9 6 6 6
10 |    7 10 7 11 6 8
==================================================================
==================================================================
     TX  perbyte calibration
==================================================================
DQS loop = 15, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqsdly_pass[0]=15,  finish count=1
dqs_perbyte_dly.last_dqsdly_pass[1]=15,  finish count=2
DQ loop=15, cmp_err_1 = ffff0082
dqs_perbyte_dly.last_dqdly_pass[1]=15,  finish count=1
DQ loop=14, cmp_err_1 = ffff0000
dqs_perbyte_dly.last_dqdly_pass[0]=14,  finish count=2
byte:0, (DQS,DQ)=(8,8)
byte:1, (DQS,DQ)=(8,8)
DRAMC_DQODLY1[200]=88888888
DRAMC_DQODLY2[204]=88888888
20,data:88
[EMI] DRAMC calibration passed

===================================================================
                MT7621   stage1 code done
                CPU=500000000 HZ BUS=166666666 HZ
===================================================================


U-Boot 1.1.3 (May 11 2020 - 10:41:20)

Board: Ralink APSoC DRAM:  128 MB
Power on memory test. Memory size= 128 MB...OK!
relocate_code Pointer at: 87fb0000

Config XHCI 40M PLL
RT2880_RSTSTAT_REG 0xc0030004
******************************
Software System Reset Occurred
******************************
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
============================================
Ralink UBoot Version: 5.0.0.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR3
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/3
Flash component: SPI Flash
Date:May 11 2020  Time:10:41:20
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768

 ##### The CPU freq = 880 MHZ ####
 estimate memory size =128 Mbytes
#Reset_MT7530
set LAN/WAN LLLLW

restore_defaults:0

Please choose the operation:
   1: Load system code to SDRAM via TFTP.
   2: Load system code then write to Flash via TFTP.
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   7: Load Boot Loader code then write to Flash via Serial.
   9: Load Boot Loader code then write to Flash via TFTP.

   n3: System Boot system code via Flash.
Booting System 1
Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
.
done
## Booting image at bc180000 ...
   Image Name:   MIPS OpenWrt Linux-3.10.14
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1863104 Bytes =  1.8 MB
   Load Address: 81001000
   Entry Point:  813f3080
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
Erasing SPI Flash...
raspi_erase: offs:30000 len:10000
.
Writing to SPI Flash...
.
done
commandline uart_en=0 factory_mode=0 mem=128m root=/dev/mtdblock9
No initrd
## Transferring control to Linux (at address 813f3080) ...
## Giving linux memsize in MB, 128

Starting kernel ...


LINUX started...

any suggestion? and what if i use ch341 programmer to erase the ic flash and rewrite using @Zorro dump file, is it going to fix my bootlooped router?
thank you, sorry for my bad english

Kaan · 2020-12-18T13:07:34.101Z

[ ID] Interval           Transfer     Bandwidth       Jitter    Lost/Total Datagrams
[  4]   0.00-100.00 sec  5.44 GBytes   468 Mbits/sec  0.205 ms  272159/713276 (38%)
[  4] Sent 713276 datagrams
[  6]   0.00-100.00 sec  5.44 GBytes   468 Mbits/sec  0.182 ms  272175/713276 (38%)
[  6] Sent 713276 datagrams
[SUM]   0.00-100.00 sec  10.9 GBytes   935 Mbits/sec  0.194 ms  544334/1426552 (38%)

chip rev: 196867

Test ended with 92% with your other firmware.

db260179 · 2020-12-18T13:38:13.690Z

So does your xiaomi 4ag have the timed out issue? before this test firmware?

db260179 · 2020-12-18T13:49:48.205Z

Try this

Xiaomi Mi Router 4A Gigabit Edition (R4AG/R4A Gigabit) -- fully supported and flashable with OpenWRTInvasion For Developers

Do a backup with flashrom first - really important! then hex edit a copy as per article from this forum i mentioned, there is an openwrt article as well Also top of this page Using the Bless hex editor I open the SPI FLASH dump and find the "bootdelay" parameter at 0x19690 is set to "off": [bless1] I can change the value to something more convenient, say 5 seconds to, hopefully, be able to interact with the bootloader: [bless2] Also change the uart_en=0 to uart_en=1 and other variable…

Further up this thread!

I wouldnt flash someone elses image until you have done a programmer backup first, as you will lose your mac addresses.

Its possible you have a bad router?

aelitasch · 2020-12-18T14:46:50.103Z

I just buy this router yesterday so i don't think that my router is bad / broken
and to be honest i don't have experience with ch341, so is that true after i modify the bootloader delay to 5 seconds, i can interact or put a command line to my router using serial ttl? and
how can i transfer the openwrt / stock .bin file to my router? if your answer tftpd, is tinypxe also tftp method? or can u describe the detail steps after modify the boot delay?? thank you...

db260179 · 2020-12-18T15:05:28.514Z

All the info is above in this thread. Im afraid i dont have time to teach people, maybe someone can assist from this thread?

alexz-kh · 2020-12-23T15:34:17.084Z

Folks, is someone have instruction how-to migrate from breed loader to uboot?
Or how-to flash latest openwrt fw from breed for that router?
(i mean,correctly -with alive options save to rom and so one- my last attemtp was alive only before reboot - than - all configs dropped to wrt defaults )

(just in case, older version reported as
Xiaomi Mi Router 3G v2
MediaTek MT7621 ver:1 eco:3 )

arutharen · 2020-12-23T20:48:07.601Z

Hey there,

I just wanted to flash @araujorm's 2020-10-22 dated firmware over my own 19.07.3 firmware (kept my settings) for better WiFi performance but i couldn't update opkg list or install any packages via Luci interface after that. I did a clean installation later on, then i couldn't reach the WebGui no matter what i did. I had to revert back to my old firmware for now.

Do you have any idea why i couldn't install any packages or reach the WebGui?

md5sum: fe468d86816b1abff0b5c0fb80a1e838

zandatsu07 · 2020-12-24T02:19:51.667Z

I suggest you to build your own firmware using snapshot,the opkg there is working fine for me and i can install package with no probs

arutharen · 2020-12-24T08:27:50.000Z

Thank you for the reply.

As far as i can see, people can install packages and reach Luci interface without any problem with @araujorm's firmware. I was asking the question according to that.

The firmware i'm using right now is my own build and i think it's not worth all of the efforts (Installing Ubuntu, downloading packages, compiling etc.) for just a few bytes. I'm talking about just for my purposes ofcourse.

It's more convenient for me to use prebuild firmware.

araujorm · 2020-12-24T09:42:12.003Z

Hi.

Using Luci doesn't work correctly, because that way it doesn't use my repo as override. Connect via SSH, do a opkg update and opkg install from there.

But my build is outdated, and I'm not maintaining it at the moment. If anything isn't working, try using the ones from @db260179 as he provides the image builder with everything you should need.